zeroclaw-labs/zeroclaw · error

empty session token

Error message

empty session token

What it means

validate_session rejects an empty string up front (nevis.rs:249-251) before calling the userinfo endpoint. It is the same fail-fast guard as validate_token, but for cookie-based session tokens.

Source

Thrown at crates/zeroclaw-runtime/src/security/nevis.rs:250

    #[allow(clippy::unused_async)] // Will use async when JWKS validation is implemented
    async fn validate_token_local(&self, token: &str) -> Result<NevisIdentity> {
        // JWT structure check: header.payload.signature
        let parts: Vec<&str> = token.split('.').collect();
        if parts.len() != 3 {
            bail!("Invalid JWT structure: expected 3 dot-separated parts");
        }

        bail!(
            "Local JWKS token validation is not yet implemented. \
             Set token_validation = \"remote\" to use the Nevis introspection endpoint."
        );
    }

    /// Validate a Nevis session token (cookie-based sessions).
    pub async fn validate_session(&self, session_token: &str) -> Result<NevisIdentity> {
        if session_token.is_empty() {
            bail!("empty session token");
        }

        let session_url = format!(
            "{}/auth/realms/{}/protocol/openid-connect/userinfo",
            self.instance_url.trim_end_matches('/'),
            self.realm,
        );

        let resp = self
            .http_client
            .get(&session_url)
            .bearer_auth(session_token)
            .send()
            .await
            .context("Failed to reach Nevis userinfo endpoint")?;

        if !resp.status().is_success() {
            bail!(

View on GitHub (pinned to 88bb9c8533)

Solutions

1. Treat an absent or empty session cookie as 'not authenticated' (401 or redirect to login) before calling validate_session
2. Check the exact cookie name your Nevis instance sets against your extraction logic
3. Confirm Secure/SameSite settings allow the cookie on your deployment origin

Example fix

// before
let session = cookies.get("session").map(|c| c.value().to_string()).unwrap_or_default();
let id = provider.validate_session(&session).await?;

// after
let Some(session) = cookies.get("session").map(|c| c.value()).filter(|s| !s.is_empty()) else {
    return unauthorized_redirect_to_login();
};
let id = provider.validate_session(session).await?;

let session = cookies
    .get(SESSION_COOKIE)
    .map(|c| c.value())
    .filter(|s| !s.trim().is_empty());
let Some(session) = session else {
    return redirect_to_login();
};

Match err.to_string().contains("empty session token") and treat the caller as anonymous: 401 or a login redirect, never a 500.

When it happens

Trigger: Calling validate_session with an empty string — usually because the session cookie was absent, named differently than expected, or failed to parse from the Cookie header.

Common situations: Cookie flags (Secure/SameSite) prevent the cookie from arriving cross-origin; cookie name mismatch between client and gateway; the request is the anonymous first hit before any session exists.

Related errors

• empty bearer token
• Invalid JWT structure: expected 3 dot-separated parts
• MFA is required but user '{}' has not completed MFA verifica
• Nevis session expired
• Nevis introspection returned HTTP {}

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/2025160879bd9420. Report an issue: GitHub.