owasp-amass/amass · error

terminateSession: status=%s error=%s

Error message

terminateSession: status=%s error=%s

What it means

Returned by Client.TerminateSession when DELETE /api/v1/sessions/{token} returns a status other than 204 and the response body IS a decodable JSON error, so the message includes the server's own error text after 'error='. It reports both the HTTP status and the reason the server refused to terminate the session.

Source

Thrown at engine/api/client/v1/client.go:162

	return tokens, nil
}

// Terminates the session associated with the provided token.
func (c *Client) TerminateSession(ctx context.Context, token uuid.UUID) error {
	resp, err := amasshttp.RequestWebPage(ctx, c.httpClient, &amasshttp.Request{
		Method: http.MethodDelete,
		URL:    c.base + "/sessions/" + token.String(),
	})
	if err != nil {
		return err
	}

	if resp.StatusCode != http.StatusNoContent {
		msg, err := readJSONError(resp.Body)
		if err != nil {
			return fmt.Errorf("terminateSession: status=%s", resp.Status)
		}
		return fmt.Errorf("terminateSession: status=%s error=%s", resp.Status, msg)
	}
	return nil
}

// Retrieves statistics for the session associated with the provided token.
func (c *Client) SessionStats(ctx context.Context, token uuid.UUID) (*et.SessionStats, error) {
	resp, err := amasshttp.RequestWebPage(ctx, c.httpClient,
		&amasshttp.Request{URL: c.base + "/sessions/" + token.String() + "/stats"})
	if err != nil {
		return nil, err
	}

	if resp.StatusCode != http.StatusOK {
		msg, err := readJSONError(resp.Body)
		if err != nil {
			return nil, fmt.Errorf("%s/stats: status=%s", token.String(), resp.Status)
		}
		return nil, fmt.Errorf("%s/stats: status=%s error=%s", token.String(), resp.Status, msg)

View on GitHub (pinned to 79299dce87)

Solutions

  1. Read the 'error=' portion of the message - it is the server's own reason and usually names the exact problem (e.g. session not found)
  2. For 'not found' errors, skip termination: the session is already gone, or re-list via ListSessions to get valid tokens
  3. For 401/403, fix server auth/permissions or the client's credentials
  4. Verify the token originates from the same server instance you are calling (CreateSession/ListSessions on this client)
  5. Retry with backoff for 5xx responses

Example fix

// before: assuming any terminate error means retry
if err := client.TerminateSession(ctx, token); err != nil {
    retry(token)
}

// after: treat 404-style 'not found' errors as success
if err := client.TerminateSession(ctx, token); err != nil {
    if strings.Contains(err.Error(), "404") {
        return nil // already terminated
    }
    return err
}
Defensive patterns

Strategy: try-catch

Validate before calling

// Go: only terminate tokens from this server
tokens, err := c.ListSessions(ctx)
if err != nil {
    return err
}
valid := false
for _, t := range tokens {
    if t == token {
        valid = true
    }
}
if !valid {
    return fmt.Errorf("token %s not managed by this server", token)
}

Try / catch

// Go
if err := c.TerminateSession(ctx, token); err != nil {
    msg := err.Error()
    switch {
    case strings.Contains(msg, "404"):
        log.Printf("session %s already terminated", token)
        return nil
    case strings.Contains(msg, "401"), strings.Contains(msg, "403"):
        return fmt.Errorf("auth failure terminating session: %w", err)
    default:
        return backoffRetry(func() error { return c.TerminateSession(ctx, token) })
    }
}

Prevention

When it happens

Trigger: Calling TerminateSession(ctx, token) when the server actively rejects the delete with a JSON error body: the session token does not exist (404 with a JSON error message), malformed/unknown token format rejected by routing, the server refuses due to auth (401/403) and returns a JSON error, or an internal failure while removing the session (500).

Common situations: Token already terminated by another client or process; token copied from a different engine instance; server-side permission config blocking the DELETE; transient internal error during session cleanup.

Understand the failure class

Background: "API error: {status}" and "HTTP 401/403/404/429/5xx" errors: non-2xx HTTP responses explained — this error's family across 27 libraries.

Related errors

AI-assisted analysis of owasp-amass/amass@79299dce87 (2026-09-06). Data as JSON: /api/errors/70a8e2eb3c77cff7. Report an issue: GitHub.