{"id":"67be907e31485acc","repo":"gofiber/fiber","slug":"session-id-cannot-be-empty","errorCode":null,"errorMessage":"session ID cannot be empty","messagePattern":"session ID cannot be empty","errorType":"validation","errorClass":"ErrEmptySessionID","httpStatus":null,"severity":"error","filePath":"middleware/session/store.go","lineNumber":18,"sourceCode":"package session\n\nimport (\n\t\"context\"\n\t\"encoding/gob\"\n\t\"errors\"\n\t\"fmt\"\n\t\"time\"\n\n\t\"github.com/gofiber/fiber/v3\"\n\t\"github.com/gofiber/fiber/v3/extractors\"\n\t\"github.com/gofiber/fiber/v3/internal/storage/memory\"\n\t\"github.com/gofiber/fiber/v3/log\"\n)\n\n// ErrEmptySessionID is an error that occurs when the session ID is empty.\nvar (\n\tErrEmptySessionID                   = errors.New(\"session ID cannot be empty\")\n\tErrSessionAlreadyLoadedByMiddleware = errors.New(\"session already loaded by middleware\")\n\tErrSessionIDNotFoundInStore         = errors.New(\"session ID not found in session store\")\n)\n\n// sessionIDKey is the local key type used to store and retrieve the session ID in context.\ntype sessionIDKey int\n\nconst (\n\t// sessionIDContextKey is the key used to store the session ID in the context locals.\n\tsessionIDContextKey sessionIDKey = iota\n\t// sessionExtractorContextKey stores the extractor that provided the session ID.\n\tsessionExtractorContextKey\n)\n\n// Store manages session data using the configured storage backend.\ntype Store struct {\n\tConfig\n}","sourceCodeStart":1,"sourceCodeEnd":36,"githubUrl":"https://github.com/gofiber/fiber/blob/9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c/middleware/session/store.go#L1-L36","documentation":"Declared as ErrEmptySessionID and returned by Store.Delete and Store.GetByID when the supplied id is the empty string. These methods require a concrete session identifier to act on; an empty id is a programmer error (no session to act on), so it is rejected up front rather than passed to the storage backend.","triggerScenarios":"Calling store.Delete(ctx, '') or store.GetByID(ctx, '') — typically because a session-id variable was never set, an extractor returned empty, or a cookie was missing and the caller passed the zero value through unchanged.","commonSituations":"Logging out when no session cookie exists; background cleanup jobs iterating over IDs that may be empty; calling GetByID with a value read from a missing/empty header or query param.","solutions":["Guard the call site: if id == '' skip or return early before calling Delete/GetByID.","Trace where the empty id originates (extractor config, cookie name, header) and ensure it is populated.","Treat an empty id as 'no session' in your handler logic rather than forwarding it to the store."],"exampleFix":"// before\nif err := store.Delete(c.Context(), sessID); err != nil { ... }\n\n// after\nif sessID != \"\" {\n    if err := store.Delete(c.Context(), sessID); err != nil { ... }\n}","handlingStrategy":"validation","validationCode":"if sessID == \"\" {\n    // nothing to delete/load — handle as 'no session'\n    return nil\n}\nreturn store.Delete(ctx, sessID)","typeGuard":null,"tryCatchPattern":"if err := store.Delete(ctx, sessID); err != nil {\n    if errors.Is(err, session.ErrEmptySessionID) {\n        // caller passed an empty id — log and ignore\n        return nil\n    }\n    return err\n}","preventionTips":["Always check id != \"\" before calling Store.Delete / Store.GetByID.","Trace empty ids back to their extractor/cookie source and fix the missing population.","Treat an empty id as 'no session' in handler logic."],"tags":["session","validation","storage"],"analyzedSha":"9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c","analyzedAt":"2026-08-04T21:44:03.395Z","schemaVersion":2}