{"record":{"id":"e3b9ce40dea9bfc0","repo":"kgretzky/evilginx2","slug":"session-already-exists-s","errorCode":null,"errorMessage":"session already exists: %s","messagePattern":"session already exists: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"database/db_session.go","lineNumber":45,"sourceCode":"\tUpdateTime   int64                              `json:\"update_time\"`\n}\n\ntype CookieToken struct {\n\tName     string\n\tValue    string\n\tPath     string\n\tHttpOnly bool\n}\n\nfunc (d *Database) sessionsInit() {\n\td.db.CreateIndex(\"sessions_id\", SessionTable+\":*\", buntdb.IndexJSON(\"id\"))\n\td.db.CreateIndex(\"sessions_sid\", SessionTable+\":*\", buntdb.IndexJSON(\"session_id\"))\n}\n\nfunc (d *Database) sessionsCreate(sid string, phishlet string, landing_url string, useragent string, remote_addr string) (*Session, error) {\n\t_, err := d.sessionsGetBySid(sid)\n\tif err == nil {\n\t\treturn nil, fmt.Errorf(\"session already exists: %s\", sid)\n\t}\n\n\tid, _ := d.getNextId(SessionTable)\n\n\ts := &Session{\n\t\tId:           id,\n\t\tPhishlet:     phishlet,\n\t\tLandingURL:   landing_url,\n\t\tUsername:     \"\",\n\t\tPassword:     \"\",\n\t\tCustom:       make(map[string]string),\n\t\tBodyTokens:   make(map[string]string),\n\t\tHttpTokens:   make(map[string]string),\n\t\tCookieTokens: make(map[string]map[string]*CookieToken),\n\t\tSessionId:    sid,\n\t\tUserAgent:    useragent,\n\t\tRemoteAddr:   remote_addr,\n\t\tCreateTime:   time.Now().UTC().Unix(),","sourceCodeStart":27,"sourceCodeEnd":63,"githubUrl":"https://github.com/kgretzky/evilginx2/blob/4c0988a1d9db4d172a185e979a38bfd0efdb5830/database/db_session.go#L27-L63","documentation":"This error comes from the evilginx2-style Database layer backed by buntdb. sessionsCreate() first looks up an existing session by its session_id (sid) via sessionsGetBySid(); if that lookup succeeds, a session with this sid already exists in the 'sessions' table, so creation is refused to keep session_id unique. It is a guard against duplicate session records, not an internal failure.","triggerScenarios":"Calling CreateSession/sessionsCreate with a sid that already exists in the sessions table — e.g. re-invoking creation with the same session_id, a client retrying a request that already created a session, or a SID generator (cookie/token reuse) producing a duplicate value.","commonSituations":"A phishing victim's browser replays a request with an already-issued session cookie, causing the proxy to attempt creating the same session again; automation/scripts calling CreateSession twice with a fixed sid; restored/imported database files that already contain the sid being reused.","solutions":["Check existence first with sessionsGetBySid(sid) and skip creation if it returns nil error","Generate a cryptographically random, unique sid per visit instead of deriving it from a value that can repeat","Delete the stale session (sessionsDeleteBySid) before re-creating if replacement is intended","Treat the error as expected in the caller and fetch/reuse the existing session instead of failing"],"exampleFix":"// before\ns, err := db.CreateSession(sid, phishlet, landingURL, ua, addr)\nif err != nil { return err }\n// after\nif _, err := db.GetSessionBySid(sid); err == nil {\n    return nil // session already tracked, nothing to do\n}\ns, err := db.CreateSession(sid, phishlet, landingURL, ua, addr)\nif err != nil { return err }","handlingStrategy":"validation","validationCode":"if _, err := db.GetSessionBySid(sid); err == nil {\n    return fmt.Errorf(\"sid %q already in use\", sid)\n}\n_ = db.CreateSession(sid, phishlet, landingURL, ua, addr)","typeGuard":null,"tryCatchPattern":"s, err := db.CreateSession(sid, phishlet, landingURL, ua, addr)\nif err != nil {\n    if strings.HasPrefix(err.Error(), \"session already exists\") {\n        return db.GetSessionBySid(sid)\n    }\n    return nil, err\n}","preventionTips":["Always generate sids from a CSPRNG (e.g. crypto/rand) so collisions are negligible","Check-before-insert with GetSessionBySid when sid may come from external input","Never derive sid from client-supplied data that can repeat across requests"],"tags":["go","database","buntdb","duplicate-key","session-management"],"backgroundTag":"duplicate-record-insert","analyzedSha":"4c0988a1d9db4d172a185e979a38bfd0efdb5830","analyzedAt":"2026-09-05T19:23:07.238Z","contentChangedAt":"2026-09-05T19:23:07.238Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}