[BUG] hestia-web-terminal 1.0.3 missing web-terminal-session-auth.php causing "Your session has expired" on HestiaCP 1.9.6.

Community Support SSH
1

HestiaCP 1.9.6 / hestia-web-terminal 1.0.3 - Web Terminal Fails with “Your session has expired”

Environment

  • HestiaCP Version: 1.9.6

  • OS: Ubuntu 24.04 LTS

  • Package: hestia-web-terminal 1.0.3

  • Architecture: amd64

Problem

The Web Terminal feature in HestiaCP is inaccessible.

When clicking the Terminal button (>_) in the HestiaCP interface, the terminal window opens but immediately displays:

“Your session has expired”

As a result, no terminal session can be established for any user.

Investigation

The Web Terminal service was running normally:

systemctl status hestia-web-terminal

However, the service logs showed:

Session helper failed
Could not open input file:
/usr/local/hestia/web-terminal/web-terminal-session-auth.php

Reviewing the source code of:

/usr/local/hestia/web-terminal/server.js

showed the following authentication call:

execFileSync(
    `${process.env.HESTIA}/php/bin/php`,
    [`${process.env.HESTIA}/web-terminal/web-terminal-session-auth.php`, sessionID],
    { encoding: 'utf8' }
);

The terminal service therefore requires:

/usr/local/hestia/web-terminal/web-terminal-session-auth.php

to authenticate Hestia sessions.

Root Cause

The required file:

web-terminal-session-auth.php

was missing from the installation.

Verification:

find /usr/local/hestia -name "web-terminal-session-auth.php"

returned no results.

The installed package contents were inspected:

dpkg -L hestia-web-terminal

and the file was not present.

The downloaded package was also inspected:

apt download hestia-web-terminal
dpkg-deb -c hestia-web-terminal_1.0.3_amd64.deb

Again, the file was not included.

However, the file does exist in the HestiaCP source repository:

src/deb/web-terminal/web-terminal-session-auth.php

The build script also references deployment of this file:

src/hst_autocompile.sh

which indicates that the file should be packaged but is currently omitted from the published hestia-web-terminal 1.0.3 package.

Solution

Clone the HestiaCP source repository:

cd /tmp
git clone --depth 1 https://github.com/hestiacp/hestiacp.git

Copy the missing file:

cp /tmp/hestiacp/src/deb/web-terminal/web-terminal-session-auth.php \
   /usr/local/hestia/web-terminal/

Set permissions:

chmod 755 /usr/local/hestia/web-terminal/web-terminal-session-auth.php

Restart the service:

systemctl restart hestia-web-terminal

Result

After restoring the missing file, the Web Terminal immediately started functioning normally.

Logs now show successful PTY creation:

New pty (...) : /bin/bash as <username>

and the browser terminal opens correctly.

Recommendation

Please verify the packaging/build process for:

hestia-web-terminal 1.0.3

as the source repository contains the required authentication helper, but the published package does not include it. This appears to be a packaging defect that may affect all fresh installations using this package version.

2

Thanks for sharing the AI report.

Did you actually test it, or did you just trust what the AI said? Because if you only do that, it won’t work either. The AI didn’t verify that it wouldn’t work because the node_modules dependencies aren’t installed either.

Anyway, this issue has already been reported.:

3

Yes, I did test it before posting the solution.

The terminal now opens normally and creates a PTY session without requiring me to SSH/Bash into the server from outside HestiaCP.

The AI-assisted troubleshooting helped identify the missing file and guided the investigation, but the fix was ultimately verified by testing on the live server. Thanks for confirming that the issue has already been reported.

4

The node modules are not included in the hestia-web-terminal package so, if you only downloaded web-terminal-session-auth.php it’s impossible that it works.

5

This was not working previously as well (similar, but not exact):

There was more but seems I cannot find them right away.