{"record":{"id":"95835bb2467fd3ef","repo":"gofiber/fiber","slug":"erremptysessionid","errorCode":"ErrEmptySessionID","errorMessage":"session ID cannot be empty","messagePattern":"session ID cannot be empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"middleware/session/store.go","lineNumber":18,"sourceCode":"package session\n\nimport (\n\t\"context\"\n\t\"encoding/gob\"\n\t\"errors\"\n\t\"fmt\"\n\t\"time\"\n\n\t\"github.com/gofiber/fiber/v3\"\n\t\"github.com/gofiber/fiber/v3/extractors\"\n\t\"github.com/gofiber/fiber/v3/internal/storage/memory\"\n\t\"github.com/gofiber/fiber/v3/log\"\n)\n\n// ErrEmptySessionID is an error that occurs when the session ID is empty.\nvar (\n\tErrEmptySessionID                   = errors.New(\"session ID cannot be empty\")\n\tErrSessionAlreadyLoadedByMiddleware = errors.New(\"session already loaded by middleware\")\n\tErrSessionIDNotFoundInStore         = errors.New(\"session ID not found in session store\")\n)\n\n// sessionIDKey is the local key type used to store and retrieve the session ID in context.\ntype sessionIDKey int\n\nconst (\n\t// sessionIDContextKey is the key used to store the session ID in the context locals.\n\tsessionIDContextKey sessionIDKey = iota\n\t// sessionExtractorContextKey stores the extractor that provided the session ID.\n\tsessionExtractorContextKey\n)\n\n// Store manages session data using the configured storage backend.\ntype Store struct {\n\tConfig\n}","sourceCodeStart":1,"sourceCodeEnd":36,"githubUrl":"https://github.com/gofiber/fiber/blob/a105acad6c1e4576a77f01e02973f67e962bb58d/middleware/session/store.go#L1-L36","documentation":"The session Store requires a non-empty session ID for Acquire and related operations. ErrEmptySessionID is returned when the ID passed in is the empty string, which typically means the configured extractor (cookie/header/query) did not find a session identifier on the request.","triggerScenarios":"Calling store.Acquire(ctx, \"\"), or invoking a session operation when the extractor returned an empty value because the client sent no session cookie/header/query parameter.","commonSituations":"First-time visitor with no cookie yet; cookie name in the session config doesn't match what the client sends; SameSite/Secure blocking cross-site cookies; clients blocking cookies; misconfigured extractor key.","solutions":["Check the extractor result before calling Store methods; create a fresh session when the ID is empty.","Verify the session middleware's SessionName matches the cookie the client sends.","Ensure cookies aren't being dropped by Secure/SameSite/Domain mismatches.","Use the middleware-provided session from context instead of touching the Store directly."],"exampleFix":"// before\nid := c.Cookies(\"session\")\nsess, _ := store.Acquire(id)\n\n// after\nid := c.Cookies(\"session\")\nif id == \"\" {\n    return fiber.NewError(fiber.StatusUnauthorized, \"no session\")\n}\nsess, err := store.Acquire(id)","handlingStrategy":"validation","validationCode":"id := c.Cookies(cfg.SessionName)\nif strings.TrimSpace(id) == \"\" {\n    return fiber.NewError(fiber.StatusUnauthorized, \"session required\")\n}\nsess, err := store.Acquire(id)","typeGuard":"func hasSessionID(id string) bool { return strings.TrimSpace(id) != \"\" }","tryCatchPattern":null,"preventionTips":["Verify the cookie name matches what the client sends.","Check Secure/SameSite/Domain aren't dropping the cookie.","Use the middleware-loaded session rather than touching the Store directly."],"tags":["session","auth","config","cookie"],"backgroundTag":null,"analyzedSha":"a105acad6c1e4576a77f01e02973f67e962bb58d","analyzedAt":"2026-08-11T17:33:26.942Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}