mastra-ai/mastra · error · HTTPException

No session

Error message

No session

What it means

This HTTP 401 error is thrown when the auth provider's `getSessionIdFromRequest(request)` returns null/undefined, meaning no session identifier (cookie, bearer token, header) could be extracted from the incoming request.

Source

Thrown at packages/server/src/server/handlers/auth.ts:627

  handler: async ctx => {
    const { mastra, request } = ctx as any;
    const isStudio = isStudioRequest(request);

    try {
      const auth = getAuthProvider(mastra, isStudio);

      if (
        !auth ||
        !implementsInterface<ISessionProvider>(auth, 'refreshSession') ||
        !implementsInterface<ISessionProvider>(auth, 'getSessionIdFromRequest')
      ) {
        throw new HTTPException(404, { message: 'Session refresh not configured' });
      }

      // Get session ID from request
      const sessionId = auth.getSessionIdFromRequest(request);
      if (!sessionId) {
        throw new HTTPException(401, { message: 'No session' });
      }

      // Refresh the session
      const newSession = await auth.refreshSession(sessionId);
      if (!newSession) {
        throw new HTTPException(401, { message: 'Session expired' });
      }

      // Build response with new session headers
      const headers = new Headers({ 'Content-Type': 'application/json' });
      if (implementsInterface<ISessionProvider>(auth, 'getSessionHeaders')) {
        const sessionHeaders = auth.getSessionHeaders(newSession);
        for (const [key, value] of Object.entries(sessionHeaders)) {
          headers.append(key, value);
        }
      }

      return new Response(JSON.stringify({ success: true }), {

View on GitHub (pinned to 75dd419e61)

Solutions

1. Sign in first to obtain a session and ensure the session cookie/token is sent with the refresh request (credentials: 'include' for cross-origin fetches).
2. Confirm the session is transmitted where getSessionIdFromRequest looks for it (cookie name/header scheme).
3. Fix CORS/cookie SameSite settings so the browser actually attaches the session cookie.

Example fix

// before
fetch('/api/auth/session/refresh', { method: 'POST' });
// after
fetch('/api/auth/session/refresh', { method: 'POST', credentials: 'include' });

// ensure a session credential exists before calling refresh
if (!document.cookie.includes('mastra-session') && !localStorage.getItem('sessionToken')) {
  redirectToSignIn(); // no session to refresh
}

function hasSessionId(req: Request): boolean {
  return req.headers.has('authorization') || req.headers.has('cookie');
}

try {
  const res = await fetch('/api/auth/session/refresh', { method: 'POST', credentials: 'include' });
  if (res.status === 401) redirectToSignIn(); // no session present
} catch (e) { redirectToSignIn(); }

When it happens

Trigger: POST the session refresh endpoint without a valid session ID present in the request — missing/blank auth cookie, missing Authorization header, or a malformed credential the provider cannot parse.

Common situations: Calling the refresh endpoint before ever signing in; cookies stripped by CORS (credentials: 'omit' or SameSite blocking); token stored under a header/cookie name the provider doesn't read; expired token deleted client-side.

Related errors

• GitHub subscriptions require an authenticated repository ses
• Factory binding ${binding.id} has no authenticated session o
• Authenticated user is missing a user id
• Session expired. Run: mastra auth login
• ${validationResult.error || 'invalid_token'}

AI-assisted analysis of mastra-ai/mastra@75dd419e61 (2026-08-30). Data as JSON: /api/errors/3259fde61b541060. Report an issue: GitHub.