{"record":{"id":"26cf0984d809ea2f","repo":"remix-run/remix","slug":"session-id-session-deleteid-was-regenerated-bu","errorCode":null,"errorMessage":"Session ID ${session.deleteId} was regenerated, but the old session cannot be deleted when using cookie storage","messagePattern":"Session ID (.+?) was regenerated, but the old session cannot be deleted when using cookie storage","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"packages/session/src/lib/session-storage/cookie.ts","lineNumber":28,"sourceCode":" * @returns The session storage\n */\nexport function createCookieSessionStorage(): SessionStorage {\n  return {\n    async read(cookie) {\n      if (cookie) {\n        try {\n          let parsed = JSON.parse(cookie) as { i: string; d: SessionData }\n          return createSession(parsed.i, parsed.d)\n        } catch {\n          // Invalid JSON, fall through to create new session\n        }\n      }\n\n      return createSession()\n    },\n    async save(session) {\n      if (session.deleteId) {\n        console.warn(\n          `Session ID ${session.deleteId} was regenerated, but the old session cannot ` +\n            'be deleted when using cookie storage',\n        )\n      }\n\n      if (session.destroyed) {\n        return ''\n      }\n      if (session.dirty) {\n        return JSON.stringify({ i: session.id, d: session.data })\n      }\n\n      return null\n    },\n  }\n}\n","sourceCodeStart":10,"sourceCodeEnd":45,"githubUrl":"https://github.com/remix-run/remix/blob/9696913134be3a4423513d2775f7b31d6917c049/packages/session/src/lib/session-storage/cookie.ts#L10-L45","documentation":"When using cookie-based session storage, the entire session lives in a single cookie, so there is no server-side record to delete. If a session ID is regenerated, the middleware warns that the old session cannot be explicitly deleted; the old data simply ages out with the cookie it was set in.","triggerScenarios":"Calling session.regenerate() (or otherwise setting deleteId) on a session persisted with createCookieSessionStorage, then saving the session.","commonSituations":"Login flows that regenerate the session ID on privilege change (a common CSRF/session-fixation hardening step) while using cookie storage, which cannot honor the deletion.","solutions":["Switch to a server-side session storage (e.g. database or Redis-backed createSessionStorage) if you need true old-session deletion on regeneration","Accept the warning for cookie storage: the old cookie is overwritten on save, so the risk is limited to in-flight copies","Regenerate before writing sensitive data so the old ID never holds privileged state"],"exampleFix":"// before\nlet storage = createCookieSessionStorage({ cookie: { secrets: ['s3cret'] } })\n// after\nlet storage = createDatabaseSessionStorage(/* ... */)","handlingStrategy":"fallback","validationCode":"const canDeleteSessions = storage.deleteSession !== undefined // server-backed storage","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use server-side session storage when regenerate() is part of your security model","Regenerate sessions before elevating privileges so old IDs never hold sensitive state"],"tags":["session","cookie-storage","regenerate"],"backgroundTag":"session-id-regeneration-unsupported","analyzedSha":"9696913134be3a4423513d2775f7b31d6917c049","analyzedAt":"2026-08-27T19:55:01.024Z","schemaVersion":2},"datasetVersion":"2026-08-28T00:17:15.603Z"}