{"record":{"id":"35a16b7d4ae70b49","repo":"ory/kratos","slug":"array-must-not-be-empty","errorCode":null,"errorMessage":"array must not be empty","messagePattern":"array must not be empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"session/handler.go","lineNumber":1391,"sourceCode":"// parseManageSessionsIDsOrWildcard recognizes the network-wide wildcard form\n// [\"*\"] and otherwise delegates to parseManageSessionsIDs. Use it in fields\n// that accept the wildcard (currently `identities`); fields that do not\n// accept wildcard should call parseManageSessionsIDs directly so the token is\n// rejected.\nfunc parseManageSessionsIDsOrWildcard(raw []string) (ids []uuid.UUID, wildcard bool, err error) {\n\tif len(raw) == 1 && raw[0] == ManageSessionsAllToken {\n\t\treturn nil, true, nil\n\t}\n\tids, err = parseManageSessionsIDs(raw)\n\treturn ids, false, err\n}\n\n// parseManageSessionsIDs interprets a manage-sessions filter array as a list\n// of explicit UUIDs and rejects any input containing the wildcard token.\n// Callers that accept the wildcard must use parseManageSessionsIDsOrWildcard.\nfunc parseManageSessionsIDs(raw []string) ([]uuid.UUID, error) {\n\tif len(raw) == 0 {\n\t\treturn nil, errors.New(\"array must not be empty\")\n\t}\n\tif len(raw) > ManageSessionsMaxIDs {\n\t\treturn nil, fmt.Errorf(\"at most %d IDs may be provided per call\", ManageSessionsMaxIDs)\n\t}\n\tids := make([]uuid.UUID, 0, len(raw))\n\tfor _, s := range raw {\n\t\tif s == ManageSessionsAllToken {\n\t\t\treturn nil, errors.New(\"the wildcard '*' is not accepted here\")\n\t\t}\n\t\tid, err := uuid.FromString(s)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"could not parse %q as UUID: %w\", s, err)\n\t\t}\n\t\tids = append(ids, id)\n\t}\n\treturn ids, nil\n}\n","sourceCodeStart":1373,"sourceCodeEnd":1409,"githubUrl":"https://github.com/ory/kratos/blob/b86338da04a040247a07f46100a86dcfb3875909/session/handler.go#L1373-L1409","documentation":"parseManageSessionsIDs in the session admin API parses an explicit list of session UUIDs for manage/kill-sessions operations and rejects an empty input array, since the endpoint requires either the wildcard or at least one concrete session id. Callers that support the wildcard must use parseManageSessionsIDsOrWildcard instead.","triggerScenarios":"Calling the admin 'disable/delete my other sessions' or session management endpoints with an empty array of session ids (e.g. ids: []).","commonSituations":"Client code builds a list from user selections and submits without checking that at least one was chosen; frontend sends the request unconditionally with an empty payload.","solutions":["Include at least one session UUID in the request body, or use the wildcard '*' endpoint variant if you mean 'all sessions'","Guard on the client side: skip the API call when no sessions are selected","If 'everything' is intended, call the wildcard-accepting endpoint (parseManageSessionsIDsOrWildcard path) with \"*\"]"],"exampleFix":"// before\nPOST /admin/sessions/delete {\"ids\": []}\n// after\nPOST /admin/sessions/delete {\"ids\": [\"6d0e5a3d-...\", \"9b2f...\" ]}\n// or wildcard variant\nPOST /admin/sessions/delete {\"ids\": [\"*\"]}","handlingStrategy":"validation","validationCode":"if len(ids) === 0 throw new Error(\"at least one session id required (or use wildcard endpoint)\")","typeGuard":null,"tryCatchPattern":"try { ... } catch (e) { if (e.status === 400 && /array must not be empty/.test(e.message)) { /* fix request payload */ } }","preventionTips":["Disable submit buttons until at least one session is selected","Skip the call when the selection is empty","Use the wildcard endpoint for 'all sessions' intent"],"tags":["go","http-api","session","admin"],"backgroundTag":"empty-required-field","analyzedSha":"b86338da04a040247a07f46100a86dcfb3875909","analyzedAt":"2026-09-07T15:58:15.934Z","contentChangedAt":"2026-09-07T15:58:15.934Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}