# X_UNAUTHENTICATED

## Means

no authenticated actor for this request

## Typical cause

the two things that produce an anonymous actor where one is needed: the request carried no `__Host-x_session` cookie, or it carried one nothing resolved. `authenticate()` answers the anonymous actor for a missing cookie rather than throwing, which is why the failure surfaces one layer later, at the surface that needed the actor. Also the code for an oauth identity a local account already holds — `@ultimat3/auth` owns it, `@ultimat3/http` only borrows it

## Fix

send the `__Host-x_session` cookie with this request, and resolve it once at the boundary: `authenticate(auth, readSessionCookie(request, auth.sessions.policy))`

[HTTP](/error-codes#http)