What causes "Toutiao sessionid cookie missing" in jackwener/OpenCLI?

Run the toutiao auth login flow and complete login at https://mp.toutiao.com/auth/page/login, then re-verify.

jackwener/OpenCLI · error · AuthRequiredError

Toutiao sessionid cookie missing

Error message

Toutiao sessionid cookie missing

What it means

AuthRequiredError thrown by verifyToutiaoIdentity when the browser session has no non-empty `sessionid` cookie for https://mp.toutiao.com. That cookie is the credential proving a logged-in creator account; without it identity verification cannot proceed.

Source

Thrown at clis/toutiao/auth.js:11

import { AuthRequiredError, CommandExecutionError } from '@jackwener/opencli/errors';
import { registerSiteAuthCommands } from '../_shared/site-auth.js';

async function hasToutiaoSessionCookie(page) {
  const cookies = await page.getCookies({ url: 'https://mp.toutiao.com' });
  return cookies.some(c => c.name === 'sessionid' && c.value);
}

async function verifyToutiaoIdentity(page) {
  if (!await hasToutiaoSessionCookie(page)) {
    throw new AuthRequiredError('toutiao.com', 'Toutiao sessionid cookie missing');
  }
  await page.goto('https://mp.toutiao.com/');
  await page.wait(2);
  const probe = await page.evaluate(`
    (() => {
      if (/\\/auth\\/page\\/login/.test(location.href)) {
        return { kind: 'auth', detail: 'mp.toutiao.com redirected to /auth/page/login — anonymous' };
      }
      let userId = '', nickname = '';
      try {
        const seen = new Set();
        const stack = [window.__INITIAL_STATE__, window.__REDUX_STATE__, window.__SSR_DATA__].filter(Boolean);
        while (stack.length) {
          const node = stack.pop();
          if (!node || typeof node !== 'object' || seen.has(node)) continue;
          seen.add(node);
          if (Array.isArray(node)) { stack.push(...node); continue; }
          const u = node.userInfo || node.user || node.currentUser || node.userBase;

View on GitHub (pinned to 49907e53dc)

Solutions

Run the toutiao auth login flow and complete login at https://mp.toutiao.com/auth/page/login, then re-verify.
Open mp.toutiao.com manually in the same browser profile and confirm you stay logged in.
Point the tool at the persistent profile that actually holds the sessionid cookie; avoid incognito/ephemeral contexts.
If the session expired, log in again — the cookie cannot be recreated client-side.
Check system clock accuracy; skewed clocks cause cookies to be dropped as expired.

Example fix

// before: fresh ephemeral context with no cookies
const page = await browser.newPage();
await verifyToutiaoIdentity(page); // throws AuthRequiredError
// after: reuse a persistent logged-in profile
const context = await browser.launchPersistentContext(userDataDir, { headless: false });
const page = await context.newPage();
await toutiaoLogin(page); // ensures sessionid cookie exists
await verifyToutiaoIdentity(page);

Defensive patterns

Strategy: validation

Validate before calling

const cookies = await page.getCookies({ url: 'https://mp.toutiao.com' });
const session = cookies.find(c => c.name === 'sessionid');
if (!session || !session.value) {
  throw new Error('No mp.toutiao.com sessionid cookie — run the toutiao login flow first');
}

Type guard

function hasToutiaoSession(cookies) {
  return Array.isArray(cookies) && cookies.some(
    c => c && c.name === 'sessionid' && typeof c.value === 'string' && c.value.length > 0,
  );
}

Try / catch

try {
  const identity = await toutiaoAuthVerify(page);
} catch (err) {
  if (err.name === 'AuthRequiredError' && err.message.includes('sessionid cookie missing')) {
    await toutiaoAuthLogin(page);
    return toutiaoAuthVerify(page);
  }
  throw err;
}

Prevention

Always run the toutiao login flow before verify/scraper commands; never use incognito or ephemeral profiles.
Use a persistent user-data-dir so the sessionid cookie survives between runs.
Preflight with hasToutiaoSessionCookie before any mp.toutiao.com command.
Re-login when the session ages out — sessionid expires server-side even while still stored.
Keep the system clock accurate so cookies are not discarded as expired.

When it happens

Trigger: Invoking toutiao auth verify (or any flow calling verifyToutiaoIdentity) when page.getCookies({url:'https://mp.toutiao.com'}) returns no cookie named `sessionid` with a truthy value — never logged in, logged out, or cookies cleared.

Common situations: Running the command before completing the browser login flow; Toutiao expired/revoked the session server-side; headless browser launched with a fresh/incognito profile lacking stored cookies; browser settings or cleanup purged cookies.

Related errors

AI-assisted analysis of jackwener/OpenCLI@49907e53dc (2026-08-29). Data as JSON: /api/errors/40a0947b43f39192. Report an issue: GitHub.