gofiber/fiber · warning · ErrSessionIDNotFoundInStore

session ID not found in session store

Error message

session ID not found in session store

What it means

Declared as ErrSessionIDNotFoundInStore and returned by Store.GetByID when the storage backend returns nil data for the id (the id was never stored, was expired/evicted, or was destroyed). It is also returned when an AbsoluteTimeout has lapsed and GetByID destroys the expired session. It signals 'no such session', not a storage failure.

Source

Thrown at middleware/session/store.go:19

package session

import (
	"context"
	"encoding/gob"
	"errors"
	"fmt"
	"time"

	"github.com/gofiber/fiber/v3"
	"github.com/gofiber/fiber/v3/extractors"
	"github.com/gofiber/fiber/v3/internal/storage/memory"
	"github.com/gofiber/fiber/v3/log"
)

// ErrEmptySessionID is an error that occurs when the session ID is empty.
var (
	ErrEmptySessionID                   = errors.New("session ID cannot be empty")
	ErrSessionAlreadyLoadedByMiddleware = errors.New("session already loaded by middleware")
	ErrSessionIDNotFoundInStore         = errors.New("session ID not found in session store")
)

// sessionIDKey is the local key type used to store and retrieve the session ID in context.
type sessionIDKey int

const (
	// sessionIDContextKey is the key used to store the session ID in the context locals.
	sessionIDContextKey sessionIDKey = iota
	// sessionExtractorContextKey stores the extractor that provided the session ID.
	sessionExtractorContextKey
)

// Store manages session data using the configured storage backend.
type Store struct {
	Config
}

View on GitHub (pinned to 9a4c7e57fe)

Solutions

1. Handle the error as 'session absent': create a fresh session / treat the user as unauthenticated.
2. If using AbsoluteTimeout, expect this near timeout boundaries and migrate to a fresh session id (Regenerate) before expiry.
3. Ensure the configured Storage is shared across all instances (Redis/external) so ids resolve consistently.
4. Increase session TTL or switch to a persistent backend if sessions expire too aggressively.

Example fix

// before
sess, err := store.GetByID(ctx, id)
if err != nil { return err }

// after
sess, err := store.GetByID(ctx, id)
if errors.Is(err, session.ErrSessionIDNotFoundInStore) {
    // treat as anonymous / start fresh session
    return c.Status(fiber.StatusUnauthorized).SendString("session expired")
}
if err != nil { return err }

sess, err := store.GetByID(ctx, id)
if err != nil {
    if errors.Is(err, session.ErrSessionIDNotFoundInStore) {
        // expired/unknown/destroyed — start fresh / treat anonymous
        return c.Status(fiber.StatusUnauthorized).SendString("session expired")
    }
    return err
}

When it happens

Trigger: store.GetByID(ctx, id) with an id from an old/expired cookie, a forged id, an id whose TTL elapsed, or an id whose session was destroyed by Reset/Destroy. Also returned when Config.AbsoluteTimeout fired and the session was auto-destroyed during lookup.

Common situations: Returning users after the session TTL expired; a client presenting a stale cookie after server restart with in-memory storage; cross-instance requests when storage isn't shared; explicit session destruction followed by reuse of the old id.

Related errors

• session ID cannot be empty
• failed to reset session: %w
• file: failed to store file
• failed to type-assert to *Middleware
• fiber: shared storage is not configured

AI-assisted analysis of gofiber/fiber@9a4c7e57fe (2026-08-04). Data as JSON: /data/errors/bacee5e40fe2abbc.json. Report an issue: GitHub.