jackwener/OpenCLI · error · AuthRequiredError

`Facebook /me redirected to ${finalUrl} — logged out or in c

Error message

`Facebook /me redirected to ${finalUrl} — logged out or in checkpoint`

What it means

After confirming the c_user cookie, verifyFacebookIdentity navigates to facebook.com/me and inspects where the browser actually landed. The final URL's vanity segment must be a real profile path; if the vanity is missing, or the URL is login.php or checkpoint, Facebook bounced the 'logged-in' session out — so it throws AuthRequiredError. This catches sessions where a cookie exists but the login is not actually usable.

Source

Thrown at clis/facebook/auth.js:21

async function hasFacebookCUserCookie(page) {
  const cookies = await page.getCookies({ url: 'https://www.facebook.com' });
  return cookies.some(c => c.name === 'c_user' && c.value);
}

async function verifyFacebookIdentity(page) {
  if (!await hasFacebookCUserCookie(page)) {
    throw new AuthRequiredError('www.facebook.com', 'Facebook c_user cookie missing — anonymous session');
  }
  const cookies = await page.getCookies({ url: 'https://www.facebook.com' });
  const cUser = cookies.find(c => c.name === 'c_user')?.value || '';
  await page.goto('https://www.facebook.com/me');
  await page.wait(2);
  const finalUrl = await page.evaluate(`location.href`);
  const vanityMatch = String(finalUrl || '').match(/facebook\.com\/([^/?#]+)\/?(?:$|[?#])/);
  const vanity = vanityMatch?.[1] || '';
  if (!vanity || vanity === 'login.php' || vanity === 'checkpoint') {
    throw new AuthRequiredError('www.facebook.com', `Facebook /me redirected to ${finalUrl} — logged out or in checkpoint`);
  }
  return {
    user_id: String(cUser),
    vanity: String(vanity),
    profile_url: `https://www.facebook.com/${vanity}/`,
  };
}

registerSiteAuthCommands({
  site: 'facebook',
  domain: 'facebook.com',
  loginUrl: 'https://www.facebook.com/login.php',
  columns: ['user_id', 'vanity', 'profile_url'],
  quickCheck: hasFacebookCUserCookie,
  verify: verifyFacebookIdentity,
  poll: async (page) => {
    if (!await hasFacebookCUserCookie(page)) {
      throw new AuthRequiredError('www.facebook.com', 'Waiting for Facebook c_user cookie');

View on GitHub (pinned to 49907e53dc)

Solutions

Open the browser interactively and complete the Facebook checkpoint / 2FA challenge, then retry.
Log out and log in again to obtain a fresh valid session (stale cookie present but invalid).
Confirm manually that https://www.facebook.com/me in that browser profile lands on your profile, not login.php or checkpoint.
Use a long-lived, regularly-used browser profile so Facebook's risk system does not flag the session.

Example fix

// before
const identity = await verifyFacebookIdentity(page); // throws on checkpoint

// after
try {
  const identity = await verifyFacebookIdentity(page);
} catch (err) {
  if (err instanceof AuthRequiredError && err.message.includes('checkpoint')) {
    await pauseForManualCheckpoint(page); // let the user resolve 2FA in the browser
  }
  throw err;
}

Defensive patterns

Strategy: try-catch

Validate before calling

const finalUrl = await page.evaluate('location.href');
const m = String(finalUrl).match(/facebook\.com\/([^/?#]+)/);
const vanity = m?.[1] || '';
const usable = vanity && vanity !== 'login.php' && vanity !== 'checkpoint';
if (!usable) await resolveCheckpointInteractively(page);

Type guard

function isUsableFacebookUrl(url) {
  const m = String(url || '').match(/facebook\.com\/([^/?#]+)\/?(?:$|[?#])/);
  const vanity = m?.[1] || '';
  return vanity !== '' && vanity !== 'login.php' && vanity !== 'checkpoint';
}

Try / catch

try {
  const identity = await verifyFacebookIdentity(page);
} catch (err) {
  if (err instanceof AuthRequiredError && /checkpoint|login\.php/.test(err.message)) {
    // pause and let a human resolve the checkpoint in the browser
  } else {
    throw err;
  }
}

Prevention

Verify /me lands on a real profile after login, before batch scraping.
Handle 2FA/checkpoint interactively as soon as Facebook prompts.
Use a warmed-up, regularly-used browser profile to reduce risk flags.
Detect login.php/checkpoint in final URLs of any scrape and abort early.

When it happens

Trigger: Navigating to https://www.facebook.com/me with a c_user cookie present, but location.href after the redirect either has no facebook.com/<vanity> segment, or the vanity equals 'login.php' (logged out) or 'checkpoint' (security checkpoint / 2FA challenge).

Common situations: Facebook forced a security checkpoint (new device, suspicious activity, 2FA re-verification); session expired so /me redirects to login.php despite a stale c_user cookie; cookie present but invalid (e.g. copied profile with revoked session).

Related errors

AI-assisted analysis of jackwener/OpenCLI@49907e53dc (2026-08-29). Data as JSON: /api/errors/d023d22d66359aaa. Report an issue: GitHub.