# Bug Report: Call to get\_session\_questions fails with 403 Unauthorized,

**URL:** <https://support.prodi.gy/t/bug-report-call-to-get-session-questions-fails-with-403-unauthorized/7635>\
**Category:** Uncategorized\
**Created:** [November 17, 2025, 3:07pm UTC](https://support.prodi.gy/t/bug-report-call-to-get-session-questions-fails-with-403-unauthorized/7635 "2025-11-17T15:07:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![lkp](https://avatars.discourse-cdn.com/v4/letter/l/8797f3/32.png) [@lkp](https://support.prodi.gy/u/lkp)\
**Post date:** [November 17, 2025, 3:07pm UTC](https://support.prodi.gy/t/bug-report-call-to-get-session-questions-fails-with-403-unauthorized/7635/1 "2025-11-17T15:07:56Z")

</div>

**🐛 Bug description:**  
Call to get\_session\_questions fails with 403 Unauthorized, with response

```python
{
    "error": "Unauthorized",
    "detail": "No token provided. Not authenticated.\\n"
}

```

In the Screenshot you can see a successful (left) vs unsuccessful (right) call.

 ![prodigy_bug_screenshot](https://us1.discourse-cdn.com/flex020/uploads/prodigy/original/2X/f/f0e68a208d2257b7dfac3a07ecc223bc9aaf495f.png)

**🚶🏽‍♂️Reproduction steps:**  
_How can we recreate the bug?_  
That is the problem: I don't know how to recreate it. It just happens from time to time.

In the unsuccessful call, the Access-Control-Allow-Origin is set to `*`, which apparently causes the browser to not include the prodigy cookies. I.e. the error message is correct: the browser wasn't sending cookies, so prodigy wasn't able to check the token.

ChatGPT suggests that this might be caused by caching. The web server is sending a cached version, causing the difference in Headers.

**🖥 Environment variables:**  
`prodigy stats`:

```python
15:01:01: RECIPE: Calling recipe 'stats'

============================== ✨ Prodigy Stats ==============================

Version 1.18.2                        
License Type Prodigy Company               
Location /usr/local/lib/python3.11/site-packages/prodigy
Prodigy Home /home/prodigy/.prodigy        
Platform Linux-6.6.104.2-4.azl3-x86_64-with-glibc2.41
Python Version 3.11.13                       
spaCy Version 3.8.7                         
Database Name PostgreSQL                    
Database Id postgresql                    
Total Datasets 1                             
Total Sessions 20   

```

If you have any suggestion on how to pinpoint the problem, I would be very grateful.

---

<div class="post-metadata">

**Author:** ![magdaaniol](https://sea2.discourse-cdn.com/flex020/user_avatar/support.prodi.gy/magdaaniol/32/2787_2.png) [@magdaaniol](https://support.prodi.gy/u/magdaaniol)\
**Post date:** [November 20, 2025, 7:25pm UTC](https://support.prodi.gy/t/bug-report-call-to-get-session-questions-fails-with-403-unauthorized/7635/2 "2025-11-20T19:25:06Z")

</div>

Welcome to the forum @lkp! 👋

Thanks for a detailed report!  
The error message you see comes from Prodigy checking for the identity token in request's cookies.  
This code is deterministic - it simply checks if cookies are present in the incoming request. There's no randomness or race condition here (which could explain intermittent behavior).  
Your analysis of the headers is correct: it tells us that sometimes Prodigy can receive a cookie-less request.  
The question is where such cookie-less request come from. Cache is definitely a plausible source.

Is there any infrastructure that sits between the browser(s) and Prodigy that could have such cache layer e.g nginx or similar?

---

<div class="post-metadata">

**Author:** ![Martin-S](https://avatars.discourse-cdn.com/v4/letter/m/9de053/32.png) [@Martin-S](https://support.prodi.gy/u/Martin-S)\
**Post date:** [August 24, 2026, 12:58pm UTC](https://support.prodi.gy/t/bug-report-call-to-get-session-questions-fails-with-403-unauthorized/7635/3 "2026-08-24T12:58:24Z")

</div>

Hello @lkp ,

your issue looks very similar to the issue I encountered: [OpenID Connect - 403 Forbidden after Expiration of Access Token](https://support.prodi.gy/t/openid-connect-403-forbidden-after-expiration-of-access-token/7690)  
That issue has been patched by the Prodigy team recently.  
You may want to check out the newly released prodigy-company-plugins 0.5.2.