{"record":{"id":"c0291f3011fb6859","repo":"beego/beego","slug":"newsid-s-exist","errorCode":null,"errorMessage":"newsid %s exist","messagePattern":"newsid (.+?) exist","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/web/session/sess_file.go","lineNumber":254,"sourceCode":"\t}\n\treturn a.total\n}\n\n// SessionRegenerate Generate new sid for file session.\n// it deletes old file and create new file named from new sid.\nfunc (fp *FileProvider) SessionRegenerate(ctx context.Context, oldsid, sid string) (Store, error) {\n\tfilepder.lock.Lock()\n\tdefer filepder.lock.Unlock()\n\n\toldPath := filepath.Join(fp.savePath, string(oldsid[0]), string(oldsid[1]))\n\toldSidFile := filepath.Join(oldPath, oldsid)\n\tnewPath := filepath.Join(fp.savePath, string(sid[0]), string(sid[1]))\n\tnewSidFile := filepath.Join(newPath, sid)\n\n\t// new sid file is exist\n\t_, err := os.Stat(newSidFile)\n\tif err == nil {\n\t\treturn nil, fmt.Errorf(\"newsid %s exist\", newSidFile)\n\t}\n\n\terr = os.MkdirAll(newPath, 0o755)\n\tif err != nil {\n\t\tSLogger.Println(err.Error())\n\t}\n\n\t// if old sid file exist\n\t// 1.read and parse file content\n\t// 2.write content to new sid file\n\t// 3.remove old sid file, change new sid file atime and ctime\n\t// 4.return FileSessionStore\n\t_, err = os.Stat(oldSidFile)\n\tif err == nil {\n\t\tb, err := os.ReadFile(oldSidFile)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}","sourceCodeStart":236,"sourceCodeEnd":272,"githubUrl":"https://github.com/beego/beego/blob/939cfde380bb9f15844ad633b84f037f7da21584/server/web/session/sess_file.go#L236-L272","documentation":"The file-based session provider stores each session as savePath/<sid[0]>/<sid[1]>/<sid>. SessionRegenerate(oldsid, sid) must create a brand-new file for the new session id; if a file for the new sid already exists on disk, it refuses to overwrite it. This is a new-session-id collision with data already on disk.","triggerScenarios":"Passing a fixed/app-supplied sid that was issued before (e.g. reusing a client cookie after logout+delete-less runs); SessionIDLength configured very short making random sids collide; two concurrent requests regenerating to the same sid; stale session files left in savePath across test reruns that inject deterministic sids.","commonSituations":"Test suites with hardcoded session ids re-run against the same savePath; custom sid generation (timestamp- or user-id-based) instead of the manager's random sessionID(); short SessionIDLength in ManagerConfig; shared savePath between environments.","solutions":["Always let the session manager generate sids (manager.SessionStart with an empty/absent cookie) — it uses crypto/rand with SessionIDPrefix and adequate length.","If you generate sids yourself, use a long random value (crypto/rand, >=16 bytes hex) rather than derived-from-user values.","On this error, regenerate a fresh sid and retry once instead of surfacing it to the user.","Clean stale session files in savePath between test runs / environments."],"exampleFix":"// before (deterministic sid -> collides on rerun)\nsess, err := sm.SessionRegenerate(ctx, oldsid, \"user-1234-sid\")\n\n// after\nnewsid, _ := sm.SessionID() // or accept the manager-generated id\n// if newsid already taken, loop:\nfor {\n    if _, err = sm.SessionRegenerate(ctx, oldsid, newsid); err == nil { break }\n    newsid, _ = sm.SessionID()\n}","handlingStrategy":"retry","validationCode":"// if you generate sids yourself, verify the target file is free before regenerating\nfunc sidFileFree(savePath, sid string) bool {\n    p := filepath.Join(savePath, sid[:1], sid[1:2], sid)\n    _, err := os.Stat(p)\n    return os.IsNotExist(err)\n}","typeGuard":null,"tryCatchPattern":"for attempt := 0; attempt < 3; attempt++ {\n    store, err := mgr.SessionRegenerate(ctx, oldsid, newSid)\n    if err == nil { return store, nil }\n    if !strings.Contains(err.Error(), \"exist\") { return nil, err }\n    newSid = mustRandomSid() // collision: try a fresh random id\n}","preventionTips":["Let the manager generate session ids; never derive them from user data or timestamps.","Keep SessionIDLength at default/16+ bytes of entropy.","Purge savePath between test runs and isolate savePath per environment."],"tags":["go","beego","session","filesystem"],"backgroundTag":null,"analyzedSha":"939cfde380bb9f15844ad633b84f037f7da21584","analyzedAt":"2026-08-15T17:22:06.535Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}