{"record":{"id":"9a5d31883a00342c","repo":"overleaf/overleaf","slug":"error-resending-confirmation-code-missing-sessi","errorCode":null,"errorMessage":"error resending confirmation code. missing ${sessionKey}","messagePattern":"error resending confirmation code\\. missing (.+?)","errorType":"http","errorClass":null,"httpStatus":422,"severity":"error","filePath":"services/web/app/src/Features/User/UserEmailsController.mjs","lineNumber":330,"sourceCode":"\nconst checkExistingEmailConfirmationCode = _checkConfirmationCode(\n  'pendingExistingEmail',\n  async (req, user, email) => {\n    await UserAuditLogHandler.promises.addEntry(\n      user._id,\n      'confirm-email-via-code',\n      user._id,\n      req.ip,\n      { email }\n    )\n  }\n)\n\nconst _resendConfirmationCode =\n  (sessionKey, operation, auditLogEmailKey) => async (req, res) => {\n    const sessionData = req.session[sessionKey]\n    if (!sessionData) {\n      logger.err({}, `error resending confirmation code. missing ${sessionKey}`)\n      return res.status(422).json({\n        message: {\n          key: 'error_performing_request',\n        },\n      })\n    }\n\n    const email = sessionData.email\n\n    try {\n      await resendConfirmCodeRateLimiter.consume(email, 1, { method: 'email' })\n    } catch (err) {\n      if (err?.remainingPoints === 0) {\n        return res.status(429).json({})\n      } else {\n        throw err\n      }\n    }","sourceCodeStart":312,"sourceCodeEnd":348,"githubUrl":"https://github.com/overleaf/overleaf/blob/28ad3b03b71cb4311decdcb55c36b33ec10d72db/services/web/app/src/Features/User/UserEmailsController.mjs#L312-L348","documentation":"Guard in the _resendConfirmationCode closure factory: req.session[sessionKey] is absent, so there is no pending confirmation whose code could be resent. It fires when a user hits the resend endpoint directly without a preceding send-code request (or after session expiry), with sessionKey naming the affected flow.","triggerScenarios":"Thrown at services/web/app/src/Features/User/UserEmailsController.mjs:330 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Keep responding 422 so the client knows to restart the flow from the email-entry step","Investigate session loss (cookie flags, session store) if legitimate flows trigger it","Rate-limit the resend endpoint independently of this guard"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"28ad3b03b71cb4311decdcb55c36b33ec10d72db","analyzedAt":"2026-09-03T02:10:22.807Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-10T07:17:11.731Z"}