token not found - make sure you are not using Cookie auth on

Error message

token not found - make sure you are not using Cookie auth on the server

What it means

This error is returned by session.create after a successful login response when data.Token is empty. The legacy proxy expects token-based auth; if the backend is configured for Cookie-based authentication it does not return a token in the login payload, so the proxy cannot attach a token to subsequent API requests. It is a configuration/compatibility error telling the operator to switch the backend to token auth.

Source

Thrown at server/internal/http/legacy/session.go:194

	data := api.SessionDataPayload{}

	err := s.apiReq(http.MethodPost, "/api/login", api.SessionLoginPayload{
		Username: username,
		Password: password,
	}, &data)
	if err != nil {
		return err
	}

	s.id, s.ip = data.ID, getIp(s.r)
	s.h.sessionIPs[s.id] = s.ip // save session ip by id
	s.token = data.Token
	s.name = data.Profile.Name
	s.isAdmin = data.Profile.IsAdmin

	// if Cookie auth, the token will be empty
	if s.token == "" {
		return fmt.Errorf("token not found - make sure you are not using Cookie auth on the server")
	}

	return nil
}

func (s *session) destroy() {
	defer s.client.CloseIdleConnections()

	// logout session
	err := s.apiReq(http.MethodPost, "/api/logout", nil, nil)
	if err != nil {
		s.logger.Error().Err(err).Msg("failed to logout")
	}

	// remove session id from ip map
	delete(s.h.sessionIPs, s.id)
}

View on GitHub (pinned to b0f01cedea)

Solutions

Switch the backend to token-based authentication so login responses include a token.
Confirm with the backend release notes which auth mode is supported; align proxy version accordingly.
If Cookie auth must be kept, use a proxy variant that forwards cookies instead of requiring a bearer token.
Verify the login response actually contains a token field populated (inspect response payload) to rule out a partial/unmarshal issue.

Example fix

// before
# backend config
auth:
  mode: cookie
// after
# backend config
auth:
  mode: token  # legacy proxy requires a token in the login response

Defensive patterns

Strategy: validation

Validate before calling

if data.Profile.Name == "" || data.Token == "" {
    return errors.New("login response missing token; is the backend using cookie auth?")
}

Type guard

func loginHasToken(data *loginResponse) bool {
    return data != nil && data.Token != ""
}

Try / catch

if err := s.create(); err != nil {
    if strings.Contains(err.Error(), "token not found") {
        return fmt.Errorf("backend must use token auth, not cookie auth: %w", err)
    }
    return err
}

Prevention

Set backend auth mode to token when using the legacy proxy.
Check backend release notes for auth-mode changes after upgrades.
Validate the login payload shape once at deployment time.
Do not mix cookie-auth backends with token-expecting proxies.

When it happens

Trigger: Calling session.create against a backend configured with Cookie auth — the login/creation response succeeds (profile fields populated) but data.Token is "", triggering the guard at session.go:194.

Common situations: Migrating from a Cookie-auth backend deployment to the legacy token-based proxy; backend auth mode changed by upgrade or config flag; mixing auth modes between proxy and backend.

Related errors

AI-assisted analysis of m1k1o/neko@b0f01cedea (2026-09-01). Data as JSON: /api/errors/038285255e683f02. Report an issue: GitHub.