mattermost-community/focalboard · error

unable to get the session for the token

Error message

unable to get the session for the token

What it means

GetSession wraps the store's GetSession failure with 'unable to get the session for the token'. Given a non-empty token, the session store either cannot find it (typically an ErrNotFound, meaning expired or unknown token, since GetSession enforces a.config.SessionExpireTime) or the storage backend failed. Callers of authenticated endpoints see this when their session token is no longer valid.

Source

Thrown at server/auth/auth.go:39

	config      *config.Configuration
	store       store.Store
	permissions permissions.PermissionsService
}

// New returns a new Auth.
func New(config *config.Configuration, store store.Store, permissions permissions.PermissionsService) *Auth {
	return &Auth{config: config, store: store, permissions: permissions}
}

// GetSession Get a user active session and refresh the session if needed.
func (a *Auth) GetSession(token string) (*model.Session, error) {
	if len(token) < 1 {
		return nil, errors.New("no session token")
	}

	session, err := a.store.GetSession(token, a.config.SessionExpireTime)
	if err != nil {
		return nil, errors.Wrap(err, "unable to get the session for the token")
	}
	if session.UpdateAt < (utils.GetMillis() - utils.SecondsToMillis(a.config.SessionRefreshTime)) {
		_ = a.store.RefreshSession(session)
	}
	return session, nil
}

// IsValidReadToken validates the read token for a board.
func (a *Auth) IsValidReadToken(boardID string, readToken string) (bool, error) {
	sharing, err := a.store.GetSharing(boardID)
	if model.IsErrNotFound(err) {
		return false, nil
	}
	if err != nil {
		return false, err
	}

	if !a.config.EnablePublicSharedBoards {

View on GitHub (pinned to a84bbb65e3)

Solutions

1. Re-authenticate (log in again) to obtain a fresh session token, then retry the request
2. Clear the client's stale token/cookie and ensure the token header is populated and current
3. If unexpected, check the wrapped cause (log with %+v): ErrNotFound means expired/unknown token; other errors indicate a store/database problem
4. Review SessionExpireTime/SessionRefreshTime configuration and whether the session store persists across restarts

Example fix

// before: reusing a long-lived cached token
token := os.Getenv("FB_TOKEN") // may be expired
session, err := auth.GetSession(token)

// after: login when the session is invalid
session, err := auth.GetSession(token)
if err != nil {
    token = loginAndGetNewToken(username, password)
    session, err = auth.GetSession(token)
}

// Go: check the token exists before calling GetSession
if token == "" {
    return errors.New("no session token provided")
}
// client side: only attach a token if one was issued and not marked expired
if time.Since(issuedAt) > expireTime {
    token = refreshOrRelogin()
}

session, err := a.GetSession(token)
if err != nil {
    if strings.Contains(err.Error(), "no session token") || strings.Contains(err.Error(), "unable to get the session for the token") {
        // treat as 401: clear stored token and redirect to login
        clearTokenAndRedirectToLogin()
        return
    }
    log.Printf("session lookup failed: %+v", err) // store outage vs expiry
}

When it happens

Trigger: Calling GetSession (directly or via any authenticated API route middleware) with a token that does not exist in the store, a token older than SessionExpireTime seconds, or when the session store (database) errors during lookup. An empty token produces the distinct 'no session token' error instead.

Common situations: User session expired after SessionExpireTime of inactivity; server-side sessions were wiped (restart with ephemeral store, database reset, or switching store backends); client sends a stale/hardcoded token after logout; clock skew or misconfigured SessionExpireTime causing immediate expiry.

Related errors

• Unable to create the new user
• unable to update password
• no user ID
• No User IDs
• invalid username or password

AI-assisted analysis of mattermost-community/focalboard@a84bbb65e3 (2026-08-30). Data as JSON: /api/errors/7fc31ab95652118d. Report an issue: GitHub.