owasp-amass/amass · error

terminateSession: status=%s

Error message

terminateSession: status=%s

What it means

Returned by Client.TerminateSession when the DELETE /api/v1/sessions/{token} call returns a status other than 204 No Content, and the response body is not a decodable JSON error (readJSONError failed). The error carries only the HTTP status. This is the library signaling that session termination did not succeed, without any server-provided detail.

Source

Thrown at engine/api/client/v1/client.go:160

		tokens = append(tokens, token)
	}
	return tokens, nil
}

// Terminates the session associated with the provided token.
func (c *Client) TerminateSession(ctx context.Context, token uuid.UUID) error {
	resp, err := amasshttp.RequestWebPage(ctx, c.httpClient, &amasshttp.Request{
		Method: http.MethodDelete,
		URL:    c.base + "/sessions/" + token.String(),
	})
	if err != nil {
		return err
	}

	if resp.StatusCode != http.StatusNoContent {
		msg, err := readJSONError(resp.Body)
		if err != nil {
			return fmt.Errorf("terminateSession: status=%s", resp.Status)
		}
		return fmt.Errorf("terminateSession: status=%s error=%s", resp.Status, msg)
	}
	return nil
}

// Retrieves statistics for the session associated with the provided token.
func (c *Client) SessionStats(ctx context.Context, token uuid.UUID) (*et.SessionStats, error) {
	resp, err := amasshttp.RequestWebPage(ctx, c.httpClient,
		&amasshttp.Request{URL: c.base + "/sessions/" + token.String() + "/stats"})
	if err != nil {
		return nil, err
	}

	if resp.StatusCode != http.StatusOK {
		msg, err := readJSONError(resp.Body)
		if err != nil {
			return nil, fmt.Errorf("%s/stats: status=%s", token.String(), resp.Status)

View on GitHub (pinned to 79299dce87)

Solutions

  1. Check the embedded status: 404 typically means the session token is unknown or already terminated - re-list sessions with ListSessions and use a fresh token
  2. Verify the engine server is up (HealthCheck) if the status is 502/503
  3. Confirm the base URL given to NewClient points at the engine API root, not a UI or proxy path
  4. If the token came from an earlier run, treat it as stale and create a new session instead of terminating
  5. Retry once for transient 5xx; do not retry 4xx

Example fix

// before: terminating a possibly-stale token blindly
err := client.TerminateSession(ctx, staleToken)

// after: verify the session still exists first
tokens, err := client.ListSessions(ctx)
if err != nil {
    return err
}
for _, t := range tokens {
    if t == staleToken {
        return client.TerminateSession(ctx, staleToken)
    }
}
Defensive patterns

Strategy: try-catch

Validate before calling

// Go: verify the session still exists before terminating
exists := false
for _, t := range mustListSessions(ctx, c) {
    if t == token {
        exists = true
        break
    }
}
if !exists {
    return nil // nothing to terminate
}

Try / catch

// Go
if err := c.TerminateSession(ctx, token); err != nil {
    var retryable bool
    switch {
    case strings.Contains(err.Error(), "404"):
        return nil // already gone
    case strings.Contains(err.Error(), "50"):
        retryable = true
    }
    if retryable {
        return backoffRetry(func() error { return c.TerminateSession(ctx, token) })
    }
    return err
}

Prevention

When it happens

Trigger: Calling TerminateSession(ctx, token) with a status other than 204 and a non-JSON/empty body: the session token was already terminated or never existed on this server (404 from a proxy or route mismatch), the server is down behind a load balancer (502/503), an auth middleware rejects the request, or the server returns plain-text/HTML errors instead of the expected JSON shape.

Common situations: Terminating a session twice (second DELETE finds no session); stale session token cached from a previous server instance; wrong base URL so DELETE hits an unknown route returning HTML 404; infrastructure (nginx/ALB) intercepting the request with a non-JSON error page.

Understand the failure class

Background: "API error: {status}" and "HTTP 401/403/404/429/5xx" errors: non-2xx HTTP responses explained — this error's family across 27 libraries.

Related errors

AI-assisted analysis of owasp-amass/amass@79299dce87 (2026-09-06). Data as JSON: /api/errors/8e1e1713b5939a63. Report an issue: GitHub.