gofiber/fiber · error

ErrEmptySessionID

ErrEmptySessionID

Error message

session ID cannot be empty

What it means

The session Store requires a non-empty session ID for Acquire and related operations. ErrEmptySessionID is returned when the ID passed in is the empty string, which typically means the configured extractor (cookie/header/query) did not find a session identifier on the request.

Source

Thrown at middleware/session/store.go:18

package session

import (
	"context"
	"encoding/gob"
	"errors"
	"fmt"
	"time"

	"github.com/gofiber/fiber/v3"
	"github.com/gofiber/fiber/v3/extractors"
	"github.com/gofiber/fiber/v3/internal/storage/memory"
	"github.com/gofiber/fiber/v3/log"
)

// ErrEmptySessionID is an error that occurs when the session ID is empty.
var (
	ErrEmptySessionID                   = errors.New("session ID cannot be empty")
	ErrSessionAlreadyLoadedByMiddleware = errors.New("session already loaded by middleware")
	ErrSessionIDNotFoundInStore         = errors.New("session ID not found in session store")
)

// sessionIDKey is the local key type used to store and retrieve the session ID in context.
type sessionIDKey int

const (
	// sessionIDContextKey is the key used to store the session ID in the context locals.
	sessionIDContextKey sessionIDKey = iota
	// sessionExtractorContextKey stores the extractor that provided the session ID.
	sessionExtractorContextKey
)

// Store manages session data using the configured storage backend.
type Store struct {
	Config
}

View on GitHub (pinned to a105acad6c)

Solutions

1. Check the extractor result before calling Store methods; create a fresh session when the ID is empty.
2. Verify the session middleware's SessionName matches the cookie the client sends.
3. Ensure cookies aren't being dropped by Secure/SameSite/Domain mismatches.
4. Use the middleware-provided session from context instead of touching the Store directly.

Example fix

// before
id := c.Cookies("session")
sess, _ := store.Acquire(id)

// after
id := c.Cookies("session")
if id == "" {
    return fiber.NewError(fiber.StatusUnauthorized, "no session")
}
sess, err := store.Acquire(id)

id := c.Cookies(cfg.SessionName)
if strings.TrimSpace(id) == "" {
    return fiber.NewError(fiber.StatusUnauthorized, "session required")
}
sess, err := store.Acquire(id)

func hasSessionID(id string) bool { return strings.TrimSpace(id) != "" }

When it happens

Trigger: Calling store.Acquire(ctx, ""), or invoking a session operation when the extractor returned an empty value because the client sent no session cookie/header/query parameter.

Common situations: First-time visitor with no cookie yet; cookie name in the session config doesn't match what the client sends; SameSite/Secure blocking cross-site cookies; clients blocking cookies; misconfigured extractor key.

Related errors

• decode SHA256 password: invalid length
• fiber: keyauth middleware requires a validator function
• fiber: keyauth unsupported error token
• fiber: keyauth error_description requires error
• fiber: keyauth error_uri requires error

AI-assisted analysis of gofiber/fiber@a105acad6c (2026-08-11). Data as JSON: /api/errors/95835bb2467fd3ef. Report an issue: GitHub.