netbirdio/netbird · error

invalid session token

Error message

invalid session token

What it means

Error "invalid session token" thrown in netbirdio/netbird.

Source

Thrown at proxy/internal/auth/middleware.go:472

func (mw *Middleware) tryHeaderScheme(w http.ResponseWriter, r *http.Request, host string, config DomainConfig, hdr Header, next http.Handler) bool {
	token, _, err := hdr.Authenticate(r)
	if err != nil {
		return mw.handleHeaderAuthError(w, r, err)
	}
	if token == "" {
		return false
	}

	result, err := mw.validateSessionToken(r.Context(), host, token, config.SessionPublicKey, auth.MethodHeader)
	if err != nil {
		setHeaderCapturedData(r.Context(), "", "", nil, nil)
		status := http.StatusBadRequest
		msg := "invalid session token"
		if errors.Is(err, errValidationUnavailable) {
			status = http.StatusBadGateway
			msg = "authentication service unavailable"
		}
		http.Error(w, msg, status)
		return true
	}

	if !result.Valid {
		setHeaderCapturedData(r.Context(), result.UserID, result.UserEmail, result.Groups, result.GroupNames)
		http.Error(w, "Unauthorized", http.StatusUnauthorized)
		return true
	}

	setSessionCookie(w, token, config.SessionExpiration)
	if cd := proxy.CapturedDataFromContext(r.Context()); cd != nil {
		cd.SetUserID(result.UserID)
		cd.SetUserEmail(result.UserEmail)
		cd.SetUserGroups(result.Groups)
		cd.SetUserGroupNames(result.GroupNames)
		cd.SetAuthMethod(auth.MethodHeader.String())
	}

View on GitHub (pinned to 93e97f4bf1)

When it happens

Trigger: Thrown at proxy/internal/auth/middleware.go:472 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/d3b51632d46af8ca. Report an issue: GitHub.