zeroclaw-labs/zeroclaw · error

Nevis session validation returned HTTP {}

Error message

Nevis session validation returned HTTP {}

What it means

validate_session GETs {instance_url}/auth/realms/{realm}/protocol/openid-connect/userinfo with the session token as bearer (nevis.rs:259-272). A non-2xx answer produces this error. 401 typically means the session token is invalid or expired; 404 means wrong instance_url or realm.

Source

Thrown at crates/zeroclaw-runtime/src/security/nevis.rs:268

            bail!("empty session token");
        }

        let session_url = format!(
            "{}/auth/realms/{}/protocol/openid-connect/userinfo",
            self.instance_url.trim_end_matches('/'),
            self.realm,
        );

        let resp = self
            .http_client
            .get(&session_url)
            .bearer_auth(session_token)
            .send()
            .await
            .context("Failed to reach Nevis userinfo endpoint")?;

        if !resp.status().is_success() {
            bail!(
                "Nevis session validation returned HTTP {}",
                resp.status().as_u16()
            );
        }

        let body: UserInfoResponse = resp
            .json()
            .await
            .context("Failed to parse Nevis userinfo response")?;

        if body.sub.trim().is_empty() {
            bail!("Userinfo response has missing or empty `sub` claim");
        }

        let now = std::time::SystemTime::now()
            .duration_since(std::time::UNIX_EPOCH)
            .unwrap_or_default()
            .as_secs();

View on GitHub (pinned to 88bb9c8533)

Solutions

1. For HTTP 401, clear the session cookie and send the user to login — do not retry the same token
2. For 404, verify instance_url and realm (provider.realm() shows the configured value)
3. For 5xx, retry with backoff and surface an 'authentication service unavailable' state instead of logging users out

Parse the trailing HTTP code: 401 -> clear the session cookie and redirect to login; 404 -> alert on realm/URL misconfig; 5xx -> return 503 with Retry-After and retry with backoff.

When it happens

Trigger: validate_session with a stale or revoked session cookie; wrong realm in provider config; Nevis or its reverse proxy returning 5xx during an outage.

Common situations: User's server-side session expired while the cookie persisted; realm renamed on the IdP; a proxy rewrite strips the Authorization header in transit.

Related errors

• Nevis introspection returned HTTP {}
• Token is not active (revoked or expired)
• Nevis health check failed: HTTP {}
• GET /users/me/channels returned {}
• login failed ({status}): {body}

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/dc80b2a5dd5b885f. Report an issue: GitHub.