{"record":{"id":"8446418ea6d51dbe","repo":"ory/kratos","slug":"value-of-key-s-is-not-of-type-string-in-cookie","errorCode":null,"errorMessage":"value of key %s is not of type string in cookie","messagePattern":"value of key (.+?) is not of type string in cookie","errorType":"error_code","errorClass":"errors.Errorf","httpStatus":null,"severity":"error","filePath":"x/cookie.go","lineNumber":33,"sourceCode":"func SessionPersistValues(w http.ResponseWriter, r *http.Request, s sessions.StoreExact, id string, values map[string]interface{}) error {\n\t// The error does not matter because in the worst case we're re-writing the session cookie.\n\tcookie, _ := s.Get(r, id)\n\tfor k, v := range values {\n\t\tcookie.Values[k] = v\n\t}\n\n\treturn errors.WithStack(cookie.Save(r, w))\n}\n\n// SessionGetString returns a string for the given id and key or an error if the session is invalid,\n// the key does not exist, or the key value is not a string.\nfunc SessionGetString(r *http.Request, s sessions.StoreExact, id string, key interface{}) (string, error) {\n\tcheck := func(v map[interface{}]interface{}) (string, error) {\n\t\tvv, ok := v[key]\n\t\tif !ok {\n\t\t\treturn \"\", errors.Errorf(\"key %s does not exist in cookie: %+v\", key, id)\n\t\t} else if vvv, ok := vv.(string); !ok {\n\t\t\treturn \"\", errors.Errorf(\"value of key %s is not of type string in cookie\", key)\n\t\t} else {\n\t\t\treturn vvv, nil\n\t\t}\n\t}\n\n\tvar exactErr error\n\tcookie, err := s.GetExact(r, id, func(s *sessions.Session) bool {\n\t\t_, exactErr = check(s.Values)\n\t\treturn exactErr == nil\n\t})\n\tif err != nil {\n\t\treturn \"\", err\n\t} else if exactErr != nil {\n\t\treturn \"\", exactErr\n\t}\n\n\treturn check(cookie.Values)\n}","sourceCodeStart":15,"sourceCodeEnd":51,"githubUrl":"https://github.com/ory/kratos/blob/b86338da04a040247a07f46100a86dcfb3875909/x/cookie.go#L15-L51","documentation":"x.SessionGetString validates that the value stored under the requested key in the session cookie is actually a string. If the key exists but its Go value is not a string (after JSON decode it could be a number, bool, or map), this error is returned.","triggerScenarios":"Calling x.SessionGetString on a key that was stored as a non-string (e.g. an int/bool/map) — the key lookup succeeds but the type assertion vv.(string) fails.","commonSituations":"Storing numeric IDs or booleans in the session and later reading them as strings, session data round-tripped through a serializer that changed types (e.g. JSON numbers), or different code versions disagreeing on the value type for a key.","solutions":["Store the value as a string when writing (e.g. fmt.Sprintf(\"%d\", id)) or use the matching typed getter.","Check the session.Set call site for the same key and ensure a string is stored.","Bump the cookie store's hash/maxAge or have users re-authenticate to purge cookies with old value types.","If values may vary, read as interface{} first and convert explicitly."],"exampleFix":"// before\nsess.Values[\"attempts\"] = 3\nval, _ := x.SessionGetString(r, store, \"sid\", \"attempts\")\n// after\nsess.Values[\"attempts\"] = \"3\"\nval, _ := x.SessionGetString(r, store, \"sid\", \"attempts\")","handlingStrategy":"type-guard","validationCode":"sess, _ := store.Get(r, id)\nif _, ok := sess.Values[key].(string); !ok { /* not a string — convert or use typed accessor */ }","typeGuard":"func isCookieString(sess *sessions.Session, key interface{}) (string, bool) {\n  s, ok := sess.Values[key].(string)\n  return s, ok\n}","tryCatchPattern":"val, err := x.SessionGetString(r, store, id, key)\nif err != nil {\n  log.WithError(err).Warn(\"cookie value type mismatch; re-reading as generic value\")\n  return \"\", nil // or fall back to a typed getter\n}","preventionTips":["Always store cookie values as strings when you intend to read them with SessionGetString.","Prefer fmt.Sprintf/strconv for numeric or boolean session values at write time.","Keep the write and read sites for each key in one shared helper.","Rotate cookie store keys/names after changing a value's stored type."],"tags":["session","cookie","type-mismatch","gorilla-sessions"],"backgroundTag":"type-mismatch","analyzedSha":"b86338da04a040247a07f46100a86dcfb3875909","analyzedAt":"2026-09-07T15:58:15.934Z","contentChangedAt":"2026-09-07T15:58:15.934Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}