m1k1o/neko · error · ErrSessionNotFound

session not found

Error message

session not found

What it means

ErrSessionNotFound is a sentinel error in the neko types package indicating that a session referenced by id or token does not exist in the session manager. It is returned by Logout, UpdateProfile, sessionsDelete, sessionsDisconnect, Delete, and Authenticate when the session token/cookie or id cannot be resolved to a live session.

Source

Thrown at server/pkg/types/session.go:10

package types

import (
	"errors"
	"net/http"
	"time"
)

var (
	ErrSessionNotFound         = errors.New("session not found")
	ErrSessionAlreadyExists    = errors.New("session already exists")
	ErrSessionAlreadyConnected = errors.New("session is already connected")
	ErrSessionLoginDisabled    = errors.New("session login disabled")
	ErrSessionLoginsLocked     = errors.New("session logins locked")
)

type Cursor struct {
	X int `json:"x"`
	Y int `json:"y"`
}

type SessionProfile struct {
	Id      string
	Token   string
	Profile MemberProfile
}

type SessionState struct {

View on GitHub (pinned to b0f01cedea)

Solutions

1. Re-authenticate to obtain a fresh session (login again) and retry the operation.
2. Verify the client is sending a valid, current session token/cookie to the same server instance that created it.
3. Check that a reverse proxy/LB uses sticky sessions or shared session storage if running multiple instances.
4. Confirm session cleanup (disconnect/heartbeat timeouts) isn't removing sessions prematurely.
5. Clear stale cookies and re-login to avoid old tokens being rejected.

Example fix

// before
session, err := sessions.Authenticate(r)
handle(session) // nil session, error ignored
// after
session, err := sessions.Authenticate(r)
if errors.Is(err, types.ErrSessionNotFound) {
    // redirect client to login flow to mint a new session
    http.Redirect(w, r, "/login", http.StatusUnauthorized)
    return
}

// validate the token/cookie resolves before calling APIs
if token == "" {
    return errors.New("no session token provided")
}
if _, ok := sessions.GetByToken(token); !ok {
    return errors.New("session expired, please re-login")
}

func SessionAlive(s types.SessionManager, id string) bool {
    _, ok := s.Get(id)
    return ok
}

session, err := sessions.Authenticate(r)
if errors.Is(err, types.ErrSessionNotFound) {
    http.Error(w, "session expired", http.StatusUnauthorized)
    return
}
return err

When it happens

Trigger: Authenticate(r) with a missing/expired/invalid session cookie or token; Logout or Delete with an id for a session that already ended; UpdateProfile or sessionsDisconnect for a disconnected/cleaned-up session.

Common situations: Server restart wiping in-memory sessions while clients keep old tokens; session expiry or websocket disconnect cleanup removing the session; load balancer routing to a different neko instance than the one holding the session; cookie misconfiguration (wrong domain/path) so the token never reaches the server.

Related errors

• member does not exist
• session login disabled
• session logins locked
• session token already exists
• invalid password

AI-assisted analysis of m1k1o/neko@b0f01cedea (2026-09-01). Data as JSON: /api/errors/e2f89b2008fbadfe. Report an issue: GitHub.