What it means
When a player joins, your server asks Mojang's login servers to confirm they own Minecraft. "Invalid session" means that check failed for that player. It's almost always a problem with their game's sign-in, not your server.
Fixes for the player
Try these in order:
- Restart the game and the launcher. Fully close the Minecraft Launcher, open it again and launch.
- Sign out and back in. In the launcher, sign out of the Microsoft account, sign back in and launch again.
- Check the date and time on their computer are set automatically. A clock that's wrong by more than a few minutes breaks sign-in.
- Don't use an old or third-party launcher that hasn't been updated for Microsoft accounts.
- Check Minecraft's status. If Mojang's login servers are having problems, nobody can join any server until they're back.
If every player gets it
If nobody can join and they all see "Invalid session", Mojang's login service is probably down. Wait and try again.
Don't turn off online-mode to get round it. That lets anyone join under any name, including yours, and it doesn't fix anything once Mojang is back.
Behind a proxy
On a server behind Velocity or BungeeCord, the proxy does the login check. If only players going through the proxy get this, check the proxy's forwarding settings match the backend servers.
Questions
Is my server broken?
Almost certainly not. The check is between the player's game and Mojang. If one player gets it, it's their sign-in.
Should I set online-mode=false?
No. It removes account checks entirely, so anyone can log in as anyone.