{"record":{"id":"adb274f6a928939c","repo":"kgretzky/evilginx2","slug":"session-not-found-s","errorCode":null,"errorMessage":"session not found: %s","messagePattern":"session not found: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"database/db_session.go","lineNumber":217,"sourceCode":"\t\treturn err\n\t})\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn s, nil\n}\n\nfunc (d *Database) sessionsGetBySid(sid string) (*Session, error) {\n\ts := &Session{}\n\terr := d.db.View(func(tx *buntdb.Tx) error {\n\t\tfound := false\n\t\terr := tx.AscendEqual(\"sessions_sid\", d.getPivot(map[string]string{\"session_id\": sid}), func(key, val string) bool {\n\t\t\tjson.Unmarshal([]byte(val), s)\n\t\t\tfound = true\n\t\t\treturn false\n\t\t})\n\t\tif !found {\n\t\t\treturn fmt.Errorf(\"session not found: %s\", sid)\n\t\t}\n\t\treturn err\n\t})\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn s, nil\n}\n","sourceCodeStart":199,"sourceCodeEnd":226,"githubUrl":"https://github.com/kgretzky/evilginx2/blob/4c0988a1d9db4d172a185e979a38bfd0efdb5830/database/db_session.go#L199-L226","documentation":"Returned by sessionsGetBySid when a buntdb transaction iterates the sessions_sid index with AscendEqual for the given session_id string and finds no matching record. It means no Session carrying that session_id exists in the database. Note the same lookup is used inside sessionsCreate as an existence check, where a nil error means 'exists'.","triggerScenarios":"Calling GetSessionBySid (or sessionsUpdateUsername/sessionsUpdatePassword/sessionsDeleteBySid paths that resolve by sid) with a session_id that is absent — deleted session, purged expired session, or a sid parsed from a client cookie that was never registered.","commonSituations":"A victim's browser presents an old session cookie after the server database was wiped/restored; the session expired and was cleaned up but the client still sends the sid; typo'd or attacker-forged sid values in requests; hostname/phishlet config changes invalidating stored sessions.","solutions":["Confirm the sid exists via sessionsList before operating on it, or generate a fresh session when lookup fails","Treat the error as an unknown/expired session and issue a new one rather than retrying the same sid","Check the database file actually contains sessions (path/config pointing at the right data dir)","If sessions are being purged too early, adjust session expiry/cleanup settings"],"exampleFix":"// before\ns, err := db.GetSessionBySid(sid)\nif err != nil { return err }\n// after\ns, err := db.GetSessionBySid(sid)\nif err != nil {\n    // unknown sid: create a new session for this visitor\n    return db.CreateSession(newSid(), phishlet, landingURL, ua, addr)\n}","handlingStrategy":"try-catch","validationCode":"sessions, err := db.GetSessions()\nif err == nil {\n    found := false\n    for _, s := range sessions {\n        if s.SessionId == sid { found = true; break }\n    }\n    if !found { return nil }\n}","typeGuard":"func sessionExists(db *database.Database, sid string) bool {\n    _, err := db.GetSessionBySid(sid)\n    return err == nil\n}","tryCatchPattern":"s, err := db.GetSessionBySid(sid)\nif err != nil {\n    if strings.HasPrefix(err.Error(), \"session not found\") {\n        return newSessionForVisitor() // issue fresh session\n    }\n    return err\n}","preventionTips":["Handle unknown sids from client cookies as 'new visitor', not a hard failure","Be aware session expiry/cleanup may delete sessions between calls — always handle not-found","Verify the data directory / database file in use is the one containing your sessions"],"tags":["go","database","buntdb","not-found","session-management"],"backgroundTag":"record-not-found","analyzedSha":"4c0988a1d9db4d172a185e979a38bfd0efdb5830","analyzedAt":"2026-09-05T19:23:07.238Z","contentChangedAt":"2026-09-05T19:23:07.238Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}