gofiber/fiber · error · ErrEmptySessionID

session ID cannot be empty

Error message

session ID cannot be empty

What it means

Declared as ErrEmptySessionID and returned by Store.Delete and Store.GetByID when the supplied id is the empty string. These methods require a concrete session identifier to act on; an empty id is a programmer error (no session to act on), so it is rejected up front rather than passed to the storage backend.

Source

Thrown at middleware/session/store.go:18

package session

import (
	"context"
	"encoding/gob"
	"errors"
	"fmt"
	"time"

	"github.com/gofiber/fiber/v3"
	"github.com/gofiber/fiber/v3/extractors"
	"github.com/gofiber/fiber/v3/internal/storage/memory"
	"github.com/gofiber/fiber/v3/log"
)

// ErrEmptySessionID is an error that occurs when the session ID is empty.
var (
	ErrEmptySessionID                   = errors.New("session ID cannot be empty")
	ErrSessionAlreadyLoadedByMiddleware = errors.New("session already loaded by middleware")
	ErrSessionIDNotFoundInStore         = errors.New("session ID not found in session store")
)

// sessionIDKey is the local key type used to store and retrieve the session ID in context.
type sessionIDKey int

const (
	// sessionIDContextKey is the key used to store the session ID in the context locals.
	sessionIDContextKey sessionIDKey = iota
	// sessionExtractorContextKey stores the extractor that provided the session ID.
	sessionExtractorContextKey
)

// Store manages session data using the configured storage backend.
type Store struct {
	Config
}

View on GitHub (pinned to 9a4c7e57fe)

Solutions

1. Guard the call site: if id == '' skip or return early before calling Delete/GetByID.
2. Trace where the empty id originates (extractor config, cookie name, header) and ensure it is populated.
3. Treat an empty id as 'no session' in your handler logic rather than forwarding it to the store.

Example fix

// before
if err := store.Delete(c.Context(), sessID); err != nil { ... }

// after
if sessID != "" {
    if err := store.Delete(c.Context(), sessID); err != nil { ... }
}

if sessID == "" {
    // nothing to delete/load — handle as 'no session'
    return nil
}
return store.Delete(ctx, sessID)

if err := store.Delete(ctx, sessID); err != nil {
    if errors.Is(err, session.ErrEmptySessionID) {
        // caller passed an empty id — log and ignore
        return nil
    }
    return err
}

When it happens

Trigger: Calling store.Delete(ctx, '') or store.GetByID(ctx, '') — typically because a session-id variable was never set, an extractor returned empty, or a cookie was missing and the caller passed the zero value through unchanged.

Common situations: Logging out when no session cookie exists; background cleanup jobs iterating over IDs that may be empty; calling GetByID with a value read from a missing/empty header or query param.

Related errors

• session ID not found in session store
• failed to reset session: %w
• file: failed to store file
• log: context tag name and function are required
• logger: tag name and function are required

AI-assisted analysis of gofiber/fiber@9a4c7e57fe (2026-08-04). Data as JSON: /data/errors/67be907e31485acc.json. Report an issue: GitHub.