gofiber/fiber · error

[session] AbsoluteTimeout must be greater than or equal to I

Error message

[session] AbsoluteTimeout must be greater than or equal to IdleTimeout

What it means

The session middleware enforces that AbsoluteTimeout (the hard session lifetime cap) is not shorter than IdleTimeout (the inactivity window). If AbsoluteTimeout is set (>0) but less than IdleTimeout, configDefault() panics, because sessions would be killed by the absolute limit before an idle expiry could ever occur, making IdleTimeout meaningless.

Source

Thrown at middleware/session/config.go:147

//	cfg := configDefault()
//	cfg := configDefault(customConfig)
func configDefault(config ...Config) Config {
	// Return default config if nothing provided
	if len(config) < 1 {
		return ConfigDefault
	}

	// Override default config
	cfg := config[0]

	// Set default values
	if cfg.IdleTimeout <= 0 {
		cfg.IdleTimeout = ConfigDefault.IdleTimeout
	}

	// Ensure AbsoluteTimeout is greater than or equal to IdleTimeout.
	if cfg.AbsoluteTimeout > 0 && cfg.AbsoluteTimeout < cfg.IdleTimeout {
		panic("[session] AbsoluteTimeout must be greater than or equal to IdleTimeout")
	}

	// Check if we have a zero-value Extractor
	if cfg.Extractor.Extract == nil {
		cfg.Extractor = ConfigDefault.Extractor
	}

	if cfg.KeyGenerator == nil {
		cfg.KeyGenerator = ConfigDefault.KeyGenerator
	}

	if cfg.CookieSameSite == "" {
		cfg.CookieSameSite = ConfigDefault.CookieSameSite
	}

	return cfg
}

View on GitHub (pinned to 9a4c7e57fe)

Solutions

1. Ensure AbsoluteTimeout >= IdleTimeout (or leave AbsoluteTimeout at 0 for no absolute cap).
2. Derive AbsoluteTimeout from IdleTimeout in code, e.g. AbsoluteTimeout: idleTimeout * 2.
3. Validate the relationship in a config-loading helper before constructing the middleware.

Example fix

// before
app.Use(session.New(session.Config{
    Store:           store,
    IdleTimeout:     30 * time.Minute,
    AbsoluteTimeout: 5 * time.Minute,
}))
// after
app.Use(session.New(session.Config{
    Store:           store,
    IdleTimeout:     30 * time.Minute,
    AbsoluteTimeout: 2 * time.Hour,
}))

if cfg.AbsoluteTimeout > 0 && cfg.AbsoluteTimeout < cfg.IdleTimeout {
    log.Fatalf("session: AbsoluteTimeout (%s) must be >= IdleTimeout (%s)", cfg.AbsoluteTimeout, cfg.IdleTimeout)
}

When it happens

Trigger: Calling session.New() with a Config where AbsoluteTimeout is set to a value smaller than IdleTimeout, e.g. AbsoluteTimeout: 5*time.Minute with the default IdleTimeout of 30*time.Minute.

Common situations: Setting AbsoluteTimeout from one config source and IdleTimeout from another, with values that cross. Reducing AbsoluteTimeout during testing without adjusting IdleTimeout. Misunderstanding which value must be larger.

Related errors

• failed to type-assert to *Middleware
• favicon: file size exceeds max bytes %d
• failed to reset session: %w
• route handler 'fn' cannot be nil
• fiber: Config.RegexHandler return type must support MatchStr

AI-assisted analysis of gofiber/fiber@9a4c7e57fe (2026-08-04). Data as JSON: /data/errors/fb7d1caf5992c486.json. Report an issue: GitHub.