{"record":{"id":"4b6d01f88b8b76bc","repo":"dagger/dagger","slug":"failed-to-get-session-id-from-client-metadata","errorCode":null,"errorMessage":"failed to get session ID from client metadata","messagePattern":"failed to get session ID from client metadata","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/schema/secret.go","lineNumber":80,"sourceCode":"\tURI      string\n\tCacheKey dagql.Optional[dagql.String]\n}\n\nfunc (s *secretSchema) secret(\n\tctx context.Context,\n\tparent dagql.ObjectResult[*core.Query],\n\targs secretArgs,\n) (dagql.ObjectResult[*core.Secret], error) {\n\tsrv, err := core.CurrentDagqlServer(ctx)\n\tif err != nil {\n\t\treturn dagql.ObjectResult[*core.Secret]{}, fmt.Errorf(\"failed to get dagql server: %w\", err)\n\t}\n\tclientMetadata, err := engine.ClientMetadataFromContext(ctx)\n\tif err != nil {\n\t\treturn dagql.ObjectResult[*core.Secret]{}, fmt.Errorf(\"failed to get client metadata from context: %w\", err)\n\t}\n\tif clientMetadata.SessionID == \"\" {\n\t\treturn dagql.ObjectResult[*core.Secret]{}, fmt.Errorf(\"failed to get session ID from client metadata\")\n\t}\n\tcache, err := dagql.EngineCache(ctx)\n\tif err != nil {\n\t\treturn dagql.ObjectResult[*core.Secret]{}, fmt.Errorf(\"failed to get dagql cache: %w\", err)\n\t}\n\tif _, _, err := secretprovider.ResolverForID(args.URI); err != nil {\n\t\treturn dagql.ObjectResult[*core.Secret]{}, err\n\t}\n\n\tconcreteVal := &core.Secret{\n\t\tURIVal:         args.URI,\n\t\tSourceClientID: clientMetadata.ClientID,\n\t}\n\tvar handle dagql.SessionResourceHandle\n\tif args.CacheKey.Valid {\n\t\thandle = core.SecretHandleFromCacheKey(string(args.CacheKey.Value))\n\t} else {\n\t\tplaintext, err := concreteVal.Plaintext(ctx)","sourceCodeStart":62,"sourceCodeEnd":98,"githubUrl":"https://github.com/dagger/dagger/blob/82ba2681dbe30d3547a1dc50ea495900ab5b6047/core/schema/secret.go#L62-L98","documentation":"After retrieving client metadata, the secret resolver requires a non-empty SessionID; otherwise it throws \"failed to get session ID from client metadata\". Session ID scoping keeps secret cache keys isolated per client session, so an empty one is rejected.","triggerScenarios":"A request reaches the secret query with ClientMetadata present but SessionID == \"\" — e.g. metadata constructed without a session ID, or a client that omits the session header.","commonSituations":"Custom/engine-embedded clients building ClientMetadata manually without SessionID; stale session bookkeeping in embedded engine setups.","solutions":["Ensure the client sends its session ID with each request (the SDKs do this automatically)","When constructing ClientMetadata manually, always set SessionID to a non-empty unique value","Regenerate a fresh session (new dagger session) if the ID was lost"],"exampleFix":"// before\nmd := &engine.ClientMetadata{ClientID: clientID}\n// after\nmd := &engine.ClientMetadata{ClientID: clientID, SessionID: sessionID}","handlingStrategy":"validation","validationCode":"md, err := engine.ClientMetadataFromContext(ctx)\nif err != nil { return err }\nif md.SessionID == \"\" { return errors.New(\"SessionID must be set\") }","typeGuard":"func hasSessionID(md *engine.ClientMetadata) bool {\n    return md != nil && md.SessionID != \"\"\n}","tryCatchPattern":null,"preventionTips":["Always set SessionID when constructing ClientMetadata manually","Rely on SDKs which generate a session ID per session automatically","Treat empty session IDs as a bug in embedded engine setup"],"tags":["secrets","session","client-metadata"],"backgroundTag":"missing-session-id","analyzedSha":"82ba2681dbe30d3547a1dc50ea495900ab5b6047","analyzedAt":"2026-09-05T07:21:37.930Z","contentChangedAt":"2026-09-05T07:21:37.930Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}