{"record":{"id":"42c20610c6a7692c","repo":"oauth2-proxy/oauth2-proxy","slug":"list-of-cookies-must-be-0","errorCode":null,"errorMessage":"list of cookies must be > 0","messagePattern":"list of cookies must be > 0","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/sessions/cookie/session_store.go","lineNumber":254,"sourceCode":"\tfor err == nil {\n\t\tvar c *http.Cookie\n\t\tc, err = req.Cookie(splitCookieName(cookieName, count))\n\t\tif err == nil {\n\t\t\tcookies = append(cookies, c)\n\t\t\tcount++\n\t\t}\n\t}\n\tif len(cookies) == 0 {\n\t\treturn nil, http.ErrNoCookie\n\t}\n\treturn joinCookies(cookies, cookieName)\n}\n\n// joinCookies takes a slice of cookies from the request and reconstructs the\n// full session cookie\nfunc joinCookies(cookies []*http.Cookie, cookieName string) (*http.Cookie, error) {\n\tif len(cookies) == 0 {\n\t\treturn nil, fmt.Errorf(\"list of cookies must be > 0\")\n\t}\n\tif len(cookies) == 1 {\n\t\treturn cookies[0], nil\n\t}\n\tc := copyCookie(cookies[0])\n\tfor i := 1; i < len(cookies); i++ {\n\t\tc.Value += cookies[i].Value\n\t}\n\tc.Name = cookieName\n\treturn c, nil\n}\n\nfunc copyCookie(c *http.Cookie) *http.Cookie {\n\treturn &http.Cookie{\n\t\tName:       c.Name,\n\t\tValue:      c.Value,\n\t\tPath:       c.Path,\n\t\tDomain:     c.Domain,","sourceCodeStart":236,"sourceCodeEnd":272,"githubUrl":"https://github.com/oauth2-proxy/oauth2-proxy/blob/33c2eb92dea78204f7a18bc2dfdbccc220f39257/pkg/sessions/cookie/session_store.go#L236-L272","documentation":"joinCookies reconstructs a chunked session cookie from multiple request cookies. It requires at least one cookie; an empty slice means the caller attempted to join cookies that were never collected, so it returns this error instead of producing a nil cookie.","triggerScenarios":"loadCookie collects cookie chunks named <name>-0, <name>-1... and passes them to joinCookies; the error fires when no chunks matching the cookie name were found in the request.","commonSituations":"Request without any session cookie reaching loadCookie (first visit, cookie expired/cleared, wrong cookie name configured, cookie stripped by a proxy).","solutions":["Check whether the request actually contains the session cookie before calling loadCookie, and treat absence as 'no session' rather than an error path.","Confirm the configured cookie name matches what the client sends.","Clear stale chunked cookie state (old <name>-N cookies) on the client.","If writing code that calls joinCookies directly, guard with len(cookies) > 0."],"exampleFix":"// before\nc, err := joinCookies(cookies, name)\n// after\nif len(cookies) == 0 {\n    return nil, http.ErrNoCookie\n}\nc, err := joinCookies(cookies, name)","handlingStrategy":"type-guard","validationCode":"if len(cookies) == 0 { return nil, http.ErrNoCookie }","typeGuard":"func hasCookieChunks(cookies []*http.Cookie) bool { return len(cookies) > 0 }","tryCatchPattern":null,"preventionTips":["Treat absence of session cookies as an unauthenticated request, not a hard error.","Keep cookie names consistent between write and read paths.","Periodically expire stale chunked cookies (Max-Age: -1) on the client."],"tags":["go","http","cookies","session"],"backgroundTag":"empty-required-field","analyzedSha":"33c2eb92dea78204f7a18bc2dfdbccc220f39257","analyzedAt":"2026-09-06T08:51:53.077Z","contentChangedAt":"2026-09-06T08:51:53.077Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}