oauth2-proxy/oauth2-proxy · error

list of cookies must be > 0

Error message

list of cookies must be > 0

What it means

joinCookies reconstructs a chunked session cookie from multiple request cookies. It requires at least one cookie; an empty slice means the caller attempted to join cookies that were never collected, so it returns this error instead of producing a nil cookie.

Source

Thrown at pkg/sessions/cookie/session_store.go:254

	for err == nil {
		var c *http.Cookie
		c, err = req.Cookie(splitCookieName(cookieName, count))
		if err == nil {
			cookies = append(cookies, c)
			count++
		}
	}
	if len(cookies) == 0 {
		return nil, http.ErrNoCookie
	}
	return joinCookies(cookies, cookieName)
}

// joinCookies takes a slice of cookies from the request and reconstructs the
// full session cookie
func joinCookies(cookies []*http.Cookie, cookieName string) (*http.Cookie, error) {
	if len(cookies) == 0 {
		return nil, fmt.Errorf("list of cookies must be > 0")
	}
	if len(cookies) == 1 {
		return cookies[0], nil
	}
	c := copyCookie(cookies[0])
	for i := 1; i < len(cookies); i++ {
		c.Value += cookies[i].Value
	}
	c.Name = cookieName
	return c, nil
}

func copyCookie(c *http.Cookie) *http.Cookie {
	return &http.Cookie{
		Name:       c.Name,
		Value:      c.Value,
		Path:       c.Path,
		Domain:     c.Domain,

View on GitHub (pinned to 33c2eb92de)

Solutions

1. Check whether the request actually contains the session cookie before calling loadCookie, and treat absence as 'no session' rather than an error path.
2. Confirm the configured cookie name matches what the client sends.
3. Clear stale chunked cookie state (old <name>-N cookies) on the client.
4. If writing code that calls joinCookies directly, guard with len(cookies) > 0.

Example fix

// before
c, err := joinCookies(cookies, name)
// after
if len(cookies) == 0 {
    return nil, http.ErrNoCookie
}
c, err := joinCookies(cookies, name)

if len(cookies) == 0 { return nil, http.ErrNoCookie }

func hasCookieChunks(cookies []*http.Cookie) bool { return len(cookies) > 0 }

When it happens

Trigger: loadCookie collects cookie chunks named <name>-0, <name>-1... and passes them to joinCookies; the error fires when no chunks matching the cookie name were found in the request.

Common situations: Request without any session cookie reaching loadCookie (first visit, cookie expired/cleared, wrong cookie name configured, cookie stripped by a proxy).

Understand the failure class

Background: "must not be empty", "cannot be empty" — required-field validation errors across open-source libraries — this error's family across 41 libraries.

Related errors

• error decoding ticket to clear session: %v
• CSRF cookie failed validation
• http.Hijacker is not available on writer
• cookie signature not valid
• error initialising cipher: %v

AI-assisted analysis of oauth2-proxy/oauth2-proxy@33c2eb92de (2026-09-06). Data as JSON: /api/errors/42c20610c6a7692c. Report an issue: GitHub.