gofiber/fiber · warning · ErrNotFound

value not found

Error message

value not found

What it means

ErrNotFound ('value not found', extractors/extractors.go:64) is the shared sentinel returned by every extractor (FromHeader, FromCookie, FromQuery, FromForm, FromParam, FromAuthHeader, FromCustom) when the requested value is absent or empty. It is the normal 'no value here' signal used by Chain and by middleware (keyauth, csrf) to decide whether to try the next source or reject the request. It is not a fatal error; it is expected control flow.

Source

Thrown at extractors/extractors.go:64

	// SourceForm indicates the value is extracted from form data.
	SourceForm

	// SourceQuery indicates the value is extracted from URL query parameters.
	SourceQuery

	// SourceParam indicates the value is extracted from URL path parameters.
	SourceParam

	// SourceCookie indicates the value is extracted from cookies.
	SourceCookie

	// SourceCustom indicates the value is extracted using a custom extractor function.
	SourceCustom
)

// ErrNotFound is returned when the requested value is missing or empty.
var ErrNotFound = errors.New("value not found")

// ErrChainCycle is returned when a chain extractor recursively invokes itself.
var ErrChainCycle = errors.New("cyclic extractor chain")

// Extractor defines a value extraction method with metadata.
type Extractor struct {
	Extract    func(fiber.Ctx) (string, error)
	Key        string      // The parameter/header name used for extraction
	AuthScheme string      // The auth scheme used, e.g., "Bearer"
	Chain      []Extractor // For chained extractors, stores all extractors in the chain
	Source     Source      // The type of source being extracted from
}

// Contains reports whether this extractor, or any extractor in its chain, matches pred.
//
// If pred is nil, Contains returns false.
func (e Extractor) Contains(pred func(Extractor) bool) bool {
	if pred == nil {

View on GitHub (pinned to 9a4c7e57fe)

Solutions

1. When using a single extractor, treat ErrNotFound as 'unauthenticated' and return 401, not a 500.
2. Use Chain() to fall back across header -> cookie -> query sources so a missing value in one is not fatal.
3. Verify the header/cookie/query/param name matches what the client actually sends (case-insensitive for headers).

Example fix

// before
tok, err := extractors.FromHeader("X-API-Key").Extract(c)
if err != nil {
    return fiber.NewError(fiber.StatusInternalServerError, err.Error())
}

// after
tok, err := extractors.Chain(
    extractors.FromHeader("X-API-Key"),
    extractors.FromCookie("api_key"),
).Extract(c)
if errors.Is(err, extractors.ErrNotFound) {
    return fiber.NewError(fiber.StatusUnauthorized, "api key required")
}

// Confirm a value is present before treating it as required.
if v := c.Get("X-API-Key"); v == "" {
    return fiber.NewError(fiber.StatusUnauthorized, "api key required")
}

v, err := extractor.Extract(c)
if err != nil {
    if errors.Is(err, extractors.ErrNotFound) {
        return fiber.NewError(fiber.StatusUnauthorized, "credentials required")
    }
    return err
}

When it happens

Trigger: FromHeader("X-API-Key").Extract(c) when the header is missing; FromCookie("session").Extract(c) with no cookie; FromAuthHeader("Bearer") when the Authorization header is absent or malformed; FromParam("id") on a route that didn't define :id; Chain(...) where every source returns empty. Any extractor encountering an empty/missing value returns it.

Common situations: Auth middleware not finding a token in the configured source, clients sending tokens in a different location than configured, or route/query/cookie name typos. Normal first-request-before-login traffic also produces it.

Related errors

• cyclic extractor chain
• min constraint requires an argument
• max constraint requires an argument
• range constraint requires two arguments
• regex constraint requires a pattern argument

AI-assisted analysis of gofiber/fiber@9a4c7e57fe (2026-08-04). Data as JSON: /data/errors/8d1ecde6f82d4cd8.json. Report an issue: GitHub.