What causes "session already loaded by middleware" in gofiber/fiber?

Use ctx.Locals() / the middleware-provided session accessor instead of calling Store.Acquire.

ErrSessionAlreadyLoadedByMiddleware

ErrSessionAlreadyLoadedByMiddleware

Error message

session already loaded by middleware

What it means

The session middleware loads the session once per request and stores it in context (sessionIDContextKey / sessionExtractorContextKey). Calling Store.Acquire again on the same context would double-load state and cause consistency bugs, so the middleware rejects the second load with ErrSessionAlreadyLoadedByMiddleware.

Source

Thrown at middleware/session/store.go:19

package session

import (
	"context"
	"encoding/gob"
	"errors"
	"fmt"
	"time"

	"github.com/gofiber/fiber/v3"
	"github.com/gofiber/fiber/v3/extractors"
	"github.com/gofiber/fiber/v3/internal/storage/memory"
	"github.com/gofiber/fiber/v3/log"
)

// ErrEmptySessionID is an error that occurs when the session ID is empty.
var (
	ErrEmptySessionID                   = errors.New("session ID cannot be empty")
	ErrSessionAlreadyLoadedByMiddleware = errors.New("session already loaded by middleware")
	ErrSessionIDNotFoundInStore         = errors.New("session ID not found in session store")
)

// sessionIDKey is the local key type used to store and retrieve the session ID in context.
type sessionIDKey int

const (
	// sessionIDContextKey is the key used to store the session ID in the context locals.
	sessionIDContextKey sessionIDKey = iota
	// sessionExtractorContextKey stores the extractor that provided the session ID.
	sessionExtractorContextKey
)

// Store manages session data using the configured storage backend.
type Store struct {
	Config
}

View on GitHub (pinned to a105acad6c)

Solutions

Use ctx.Locals() / the middleware-provided session accessor instead of calling Store.Acquire.
Remove the redundant Store.Acquire call from handlers downstream of session middleware.
If you must manage sessions manually, do not register the session middleware on those routes.

Example fix

// before
app.Use(session.New())
app.Get("/me", func(c fiber.Ctx) error {
    sess, _ := store.Acquire(c.Cookies("session")) // double load
    return c.JSON(sess)
})

// after
app.Use(session.New())
app.Get("/me", func(c fiber.Ctx) error {
    sess := localsFromContext(c) // use middleware-loaded session
    return c.JSON(sess)
})

Defensive patterns

Strategy: validation

Validate before calling

// Prefer reading from context instead of double-acquiring
if v := c.Locals(sessionContextKey); v != nil {
    sess = v.(*session.Session)
} else {
    sess, err = store.Acquire(id)
}

Type guard

func sessionInContext(c fiber.Ctx) (*session.Session, bool) {
    s, ok := c.Locals(sessionContextKey).(*session.Session)
    return s, ok
}

Prevention

Don't combine session middleware with manual Store calls on the same route.
Centralize session access behind a helper that checks context first.
Document the one-load-per-request contract for new contributors.

When it happens

Trigger: Manually calling store.Acquire(ctx, id) inside a handler that runs after the session middleware has already loaded the session for that request.

Common situations: Applying session middleware to a route AND calling Store methods directly in the handler; calling Acquire twice in nested handlers; helper functions that re-load sessions without checking context.

Related errors

AI-assisted analysis of gofiber/fiber@a105acad6c (2026-08-11). Data as JSON: /api/errors/0c28117d8320ae23. Report an issue: GitHub.