ory/kratos · error · errors.Errorf

value of key is not of type string in cookie

Error message

value of key %s is not of type string in cookie

What it means

x.SessionGetString validates that the value stored under the requested key in the session cookie is actually a string. If the key exists but its Go value is not a string (after JSON decode it could be a number, bool, or map), this error is returned.

Solutions

1. Store the value as a string when writing (e.g. fmt.Sprintf("%d", id)) or use the matching typed getter.
2. Check the session.Set call site for the same key and ensure a string is stored.
3. Bump the cookie store's hash/maxAge or have users re-authenticate to purge cookies with old value types.
4. If values may vary, read as interface{} first and convert explicitly.

Example fix

// before
sess.Values["attempts"] = 3
val, _ := x.SessionGetString(r, store, "sid", "attempts")
// after
sess.Values["attempts"] = "3"
val, _ := x.SessionGetString(r, store, "sid", "attempts")

sess, _ := store.Get(r, id)
if _, ok := sess.Values[key].(string); !ok { /* not a string — convert or use typed accessor */ }

func isCookieString(sess *sessions.Session, key interface{}) (string, bool) {
  s, ok := sess.Values[key].(string)
  return s, ok
}

val, err := x.SessionGetString(r, store, id, key)
if err != nil {
  log.WithError(err).Warn("cookie value type mismatch; re-reading as generic value")
  return "", nil // or fall back to a typed getter
}

When it happens

Trigger: Calling x.SessionGetString on a key that was stored as a non-string (e.g. an int/bool/map) — the key lookup succeeds but the type assertion vv.(string) fails.

Common situations: Storing numeric IDs or booleans in the session and later reading them as strings, session data round-tripped through a serializer that changed types (e.g. JSON numbers), or different code versions disagreeing on the value type for a key.

Understand the failure class

Background: Type mismatch errors: IllegalArgumentException, TypeError and type guards across 150 open-source libraries — this error's family across 150 libraries.

Related errors

• key does not exist in cookie: %+v
• array must not be empty
• the wildcard '*' is not accepted here
• api_key auth strategy requires a string name
• api_key auth strategy requires a string value

AI-assisted analysis of ory/kratos@b86338da04 (2026-09-07). Data as JSON: /api/errors/8446418ea6d51dbe. Report an issue: GitHub.

Appendix: source

Thrown at x/cookie.go:33

func SessionPersistValues(w http.ResponseWriter, r *http.Request, s sessions.StoreExact, id string, values map[string]interface{}) error {
	// The error does not matter because in the worst case we're re-writing the session cookie.
	cookie, _ := s.Get(r, id)
	for k, v := range values {
		cookie.Values[k] = v
	}

	return errors.WithStack(cookie.Save(r, w))
}

// SessionGetString returns a string for the given id and key or an error if the session is invalid,
// the key does not exist, or the key value is not a string.
func SessionGetString(r *http.Request, s sessions.StoreExact, id string, key interface{}) (string, error) {
	check := func(v map[interface{}]interface{}) (string, error) {
		vv, ok := v[key]
		if !ok {
			return "", errors.Errorf("key %s does not exist in cookie: %+v", key, id)
		} else if vvv, ok := vv.(string); !ok {
			return "", errors.Errorf("value of key %s is not of type string in cookie", key)
		} else {
			return vvv, nil
		}
	}

	var exactErr error
	cookie, err := s.GetExact(r, id, func(s *sessions.Session) bool {
		_, exactErr = check(s.Values)
		return exactErr == nil
	})
	if err != nil {
		return "", err
	} else if exactErr != nil {
		return "", exactErr
	}

	return check(cookie.Values)
}

View on GitHub (pinned to b86338da04)