jackwener/OpenCLI · error · AuthRequiredError

Facebook c_user cookie missing — anonymous session

Error message

Facebook c_user cookie missing — anonymous session

What it means

verifyFacebookIdentity checks the Puppeteer page's cookies for www.facebook.com before scraping the profile. If no non-empty c_user cookie exists, the session is anonymous (logged out), so it throws AuthRequiredError to signal that interactive login is required. c_user is Facebook's logged-in user-id cookie; without it, /me scraping would only hit the login page.

Source

Thrown at clis/facebook/auth.js:11

import { AuthRequiredError, CommandExecutionError } from '@jackwener/opencli/errors';
import { registerSiteAuthCommands } from '../_shared/site-auth.js';

async function hasFacebookCUserCookie(page) {
  const cookies = await page.getCookies({ url: 'https://www.facebook.com' });
  return cookies.some(c => c.name === 'c_user' && c.value);
}

async function verifyFacebookIdentity(page) {
  if (!await hasFacebookCUserCookie(page)) {
    throw new AuthRequiredError('www.facebook.com', 'Facebook c_user cookie missing — anonymous session');
  }
  const cookies = await page.getCookies({ url: 'https://www.facebook.com' });
  const cUser = cookies.find(c => c.name === 'c_user')?.value || '';
  await page.goto('https://www.facebook.com/me');
  await page.wait(2);
  const finalUrl = await page.evaluate(`location.href`);
  const vanityMatch = String(finalUrl || '').match(/facebook\.com\/([^/?#]+)\/?(?:$|[?#])/);
  const vanity = vanityMatch?.[1] || '';
  if (!vanity || vanity === 'login.php' || vanity === 'checkpoint') {
    throw new AuthRequiredError('www.facebook.com', `Facebook /me redirected to ${finalUrl} — logged out or in checkpoint`);
  }
  return {
    user_id: String(cUser),
    vanity: String(vanity),
    profile_url: `https://www.facebook.com/${vanity}/`,
  };
}

View on GitHub (pinned to 49907e53dc)

Solutions

  1. Run the interactive login flow (login.php via the CLI's login command) and complete Facebook login so a c_user cookie is set.
  2. Verify cookies exist: page.getCookies({url:'https://www.facebook.com'}) should include c_user with a non-empty value.
  3. Persist/reuse a browser profile directory so the logged-in session survives restarts.
  4. Re-login if Facebook invalidated the session (password change, security checkpoint, remote logout).

Example fix

// before
const identity = await verifyFacebookIdentity(page);

// after
if (!(await hasFacebookCUserCookie(page))) {
  await runInteractiveLogin(page); // opens login.php and waits for c_user
}
const identity = await verifyFacebookIdentity(page);
Defensive patterns

Strategy: validation

Validate before calling

const cookies = await page.getCookies({ url: 'https://www.facebook.com' });
const loggedIn = cookies.some(c => c.name === 'c_user' && c.value);
if (!loggedIn) await runInteractiveLogin(page);

Type guard

function hasCUser(cookies) {
  return Array.isArray(cookies) && cookies.some(c => c.name === 'c_user' && typeof c.value === 'string' && c.value.length > 0);
}

Try / catch

try {
  const identity = await verifyFacebookIdentity(page);
} catch (err) {
  if (err instanceof AuthRequiredError) {
    await performLogin(page); // interactive login.php flow
  } else {
    throw err;
  }
}

Prevention

When it happens

Trigger: Calling verifyFacebookIdentity on a page whose getCookies('https://www.facebook.com') contains no cookie named 'c_user' with a non-empty value — i.e. the browser profile was never logged in, or the session was logged out.

Common situations: Fresh/empty browser profile used for the quick-check flow; Facebook invalidated the session server-side; cookies were cleared between runs; automation run headless without completing the interactive login.

Related errors

AI-assisted analysis of jackwener/OpenCLI@49907e53dc (2026-08-29). Data as JSON: /api/errors/686fea93bed902e3. Report an issue: GitHub.