m1k1o/neko · warning

no authentication provided

Error message

no authentication provided

What it means

SessionManagerCtx.Authenticate extracts a session token from the incoming HTTP request (via getToken, e.g. cookie or header). If no token can be found in the request, it returns this error before attempting any session lookup. It indicates the request carried no credentials at all, as opposed to an invalid/expired token (which yields types.ErrSessionNotFound).

Source

Thrown at server/internal/session/auth.go:44

		Path:     manager.config.Cookie.Path,
	})
}

func (manager *SessionManagerCtx) CookieClearToken(w http.ResponseWriter, r *http.Request) {
	cookie, err := r.Cookie(manager.config.Cookie.Name)
	if err != nil {
		return
	}

	cookie.Value = ""
	cookie.Expires = time.Unix(0, 0)
	http.SetCookie(w, cookie)
}

func (manager *SessionManagerCtx) Authenticate(r *http.Request) (types.Session, error) {
	token, ok := manager.getToken(r)
	if !ok {
		return nil, errors.New("no authentication provided")
	}

	session, ok := manager.GetByToken(token)
	if !ok {
		return nil, types.ErrSessionNotFound
	}

	if !session.Profile().CanLogin {
		return nil, types.ErrSessionLoginDisabled
	}

	return session, nil
}

func (manager *SessionManagerCtx) getToken(r *http.Request) (string, bool) {
	if manager.CookieEnabled() {
		// get from Cookie
		cookie, err := r.Cookie(manager.config.Cookie.Name)

View on GitHub (pinned to b0f01cedea)

Solutions

1. Log in / create a session first (the login endpoint sets the session cookie) and retry the request with credentials included.
2. Ensure the HTTP client sends cookies or the token header (e.g. curl --cookie / withCredentials: true in fetch/XHR).
3. Check that no reverse proxy or browser setting strips the session cookie between client and server.
4. Confirm the token's transport matches what getToken reads (cookie vs header) as expected by the server configuration.

Example fix

// before: request without credentials
fetch("/api/session", { method: "GET" })

// after: include session cookie
fetch("/api/session", { method: "GET", credentials: "include" })

hasToken := document.cookie.includes("neko_session") // or the configured cookie name
if !hasToken {
    redirectToLogin() // avoid calling authenticated endpoints without credentials
}

func hasAuthToken(r *http.Request) bool {
    _, ok := r.Cookie("neko_session") // or check configured header
    return ok
}

session, err := manager.Authenticate(r)
if err != nil {
    if err.Error() == "no authentication provided" {
        http.Error(w, "authentication required", http.StatusUnauthorized)
        return
    }
    if errors.Is(err, types.ErrSessionNotFound) {
        http.Error(w, "session expired", http.StatusUnauthorized)
        return
    }
    http.Error(w, "internal error", http.StatusInternalServerError)
    return
}

When it happens

Trigger: Any request to endpoints wrapped by the session Authenticate middleware without a session token: no session cookie set and no token header/query parameter present — typically a completely unauthenticated first request.

Common situations: A user opens the app before ever logging in; API clients (curl/scripts) that omit the auth cookie or Authorization/token header; browser cookie blocking or clearing sessions; misconfigured reverse proxy stripping cookies.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• session token already exists
• receiver session ID not found
• session not found
• session already exists
• session is already connected

AI-assisted analysis of m1k1o/neko@b0f01cedea (2026-09-01). Data as JSON: /api/errors/0208d839543ca407. Report an issue: GitHub.