kataras/iris · warning

session not found

Error message

session not found

What it means

sessions.ErrNotFound is the sentinel returned when a session ID cannot be resolved in memory storage or any registered databases — by Get, GetByID, Update, UpdateExpiration, Destroy and Delete flows. The docs recommend matching it with err.Is(err, sessions.ErrNotFound). It commonly happens after a server restart when using the default memory storage, since sessions are not persisted.

Source

Thrown at sessions/provider.go:105

	p.sessions[sid] = newSession
	p.mu.Unlock()
	return newSession
}

func (p *provider) EndRequest(ctx *context.Context, session *Session) {
	if p.dbRequestHandler != nil {
		p.dbRequestHandler.EndRequest(ctx, session)
	}
}

// ErrNotFound may be returned from `UpdateExpiration` of a non-existing or
// invalid session entry from memory storage or databases.
// Usage:
//
//	if err != nil && err.Is(err, sessions.ErrNotFound) {
//	    [handle error...]
//	}
var ErrNotFound = errors.New("session not found")

// UpdateExpiration resets the expiration of a session.
// if expires > 0 then it will try to update the expiration and destroy task is delayed.
// if expires <= 0 then it does nothing it returns nil, to destroy a session call the `Destroy` func instead.
//
// If the session is not found, it returns a `NotFound` error,  this can only happen when you restart the server and you used the memory-based storage(default),
// because the call of the provider's `UpdateExpiration` is always called when the client has a valid session cookie.
//
// If a backend database is used then it may return an `ErrNotImplemented` error if the underline database does not support this operation.
func (p *provider) UpdateExpiration(sid string, expires time.Duration) error {
	if expires <= 0 {
		return nil
	}

	p.mu.RLock()
	sess, found := p.sessions[sid]
	p.mu.RUnlock()
	if !found {

View on GitHub (pinned to 7bedaf55a0)

Solutions

1. Treat ErrNotFound as 'no session' and create a new session via sessions.Start / StartExpiring.
2. Persist sessions with a real database backend (badger, boltdb, redis) so they survive restarts.
3. Clear the stale cookie on the client when ErrNotFound is returned.
4. If clustering, use a shared session store so all instances see the same sessions.

Example fix

// before
sess := sessions.Get(ctx, sid) // nil or error on restart-lost id

// after
if err != nil && errors.Is(err, sessions.ErrNotFound) {
    sess = sessions.Start(ctx) // new session
}

// check cookie before hitting storage
if sid := ctx.GetCookie(config.Cookie); sid == "" {
    // no session yet — start a new one instead of Get(id)
}

func isSessionNotFound(err error) bool { return errors.Is(err, sessions.ErrNotFound) }

if err != nil && errors.Is(err, sessions.ErrNotFound) {
    // lost/expired session: start a fresh one, clear stale cookie
    sess = manager.Start(ctx)
}

When it happens

Trigger: Calling sess.Get(id) / GetByID(id) with an expired, destroyed, or never-created session ID; calling Update/UpdateExpiration/Delete on a session that was already destroyed or lost after a server restart with the in-memory provider.

Common situations: Server restarts while clients keep old session cookies (memory storage default); session expired due to inactivity; load-balanced deployments where another instance holds the session.

Related errors

• not implemented yet
• directoryPath is empty
• path is required
• compress: response will not be compressed
• not found

AI-assisted analysis of kataras/iris@7bedaf55a0 (2026-08-30). Data as JSON: /api/errors/1dd3c619230fd6bb. Report an issue: GitHub.