louislam/uptime-kuma · warning · Error

You are not logged in.

Error message

You are not logged in.

What it means

Thrown by exports.checkLogin(socket) in util-server.js when `socket.userID` is falsy. It is the universal authentication gate invoked at the top of nearly every socket handler (status-page, maintenance, proxy, server.js, etc.). The check relies on the socket middleware that sets socket.userID after verifying the session/JWT, so a missing userID means the connection is unauthenticated.

Source

Thrown at server/util-server.js:646

 * Allow CORS all origins
 * @param {object} res Response object from axios
 * @returns {void}
 */
exports.allowAllOrigin = (res) => {
    res.header("Access-Control-Allow-Origin", "*");
    res.header("Access-Control-Allow-Methods", "GET, PUT, POST, DELETE, OPTIONS");
    res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");
};

/**
 * Check if a user is logged in
 * @param {Socket} socket Socket instance
 * @returns {void}
 * @throws The user is not logged in
 */
exports.checkLogin = (socket) => {
    if (!socket.userID) {
        throw new Error("You are not logged in.");
    }
};

/**
 * For logged-in users, double-check the password
 * @param {Socket} socket Socket.io instance
 * @param {string} currentPassword Password to validate
 * @returns {Promise<Bean>} User
 * @throws The current password is not a string
 * @throws The provided password is not correct
 */
exports.doubleCheckPassword = async (socket, currentPassword) => {
    if (typeof currentPassword !== "string") {
        throw new Error("Wrong data type?");
    }

    let user = await R.findOne("user", " id = ? AND active = 1 ", [socket.userID]);

View on GitHub (pinned to 6b5ea01557)

Solutions

1. Re-authenticate (socket.emit("login", ...)) on reconnect and whenever an event returns this error.
2. Ensure the auth cookie/token is sent with the Socket.IO handshake (withCredentials / transport options).
3. Verify the session store is shared across all instances behind a load balancer.
4. Set trustProxy correctly so the socket middleware can validate the session.

Example fix

// before
socket.emit("saveStatusPage", ...); // fired without login -> throws "You are not logged in."

// after
socket.on("connect", async () => {
  await new Promise((res, rej) => socket.emit("login", { username, password, token }, (r) => r.ok ? res() : rej(r)));
  socket.emit("saveStatusPage", ...);
});

if (!socket.userID) { socket.emit("loginRequired"); return; }

const isAuthenticated = (socket) => !!(socket && socket.userID);

try { checkLogin(socket); } catch (e) { if (e.message === "You are not logged in.") { await reAuthenticate(socket); return; } throw e; }

When it happens

Trigger: Emitting any authenticated socket event (e.g. "addMonitor", "saveStatusPage", "getMonitorList") on a socket that never completed login, whose session expired, whose auth token was cleared, or where the auth middleware failed to attach userID. Also triggered when a browser tab is left open past session expiry and then performs an action.

Common situations: Token expiry in a long-opened browser tab; cookie not sent cross-origin; reverse proxy stripping the auth header/cookie; load balancer stickiness lost so the socket lands on an instance without the session; client reconnect after server restart without re-auth; misconfigured trustProxy breaking the session binding.

Related errors

• The token is invalid due to password change or old token
• Incorrect current password
• Invalid new password
• Slug must be string
• Slug cannot be empty

AI-assisted analysis of louislam/uptime-kuma@6b5ea01557 (2026-08-12). Data as JSON: /api/errors/9c44251fc6e9f71a. Report an issue: GitHub.