overleaf/overleaf · error

error checking confirmation code. missing ${sessionKey}

Error message

error checking confirmation code. missing ${sessionKey}

What it means

Guard inside the _checkConfirmationCode closure factory: the request session has no entry under the given sessionKey (e.g. pendingSecondaryEmail), meaning the user is trying to confirm a code without having started the send-code step, or their session expired/reset in between. The interpolated sessionKey identifies which flow (secondary or existing email) is missing state.

Source

Thrown at services/web/app/src/Features/User/UserEmailsController.mjs:195

/**
 * @param {string} sessionKey
 * @param {(req: import('express').Request, user: any, email: string, affiliationOptions: any) => Promise<void>} beforeConfirmEmail
 * @returns {Promise<*>}
 */
const _checkConfirmationCode =
  (sessionKey, beforeConfirmEmail) => async (req, res) => {
    const userId = SessionManager.getLoggedInUserId(req.session)
    const code = req.body.code
    const user = await UserGetter.promises.getUser(userId, {
      email: 1,
      'emails.email': 1,
    })

    const sessionData = req.session[sessionKey]

    if (!sessionData) {
      logger.err({}, `error checking confirmation code. missing ${sessionKey}`)

      return res.status(422).json({
        message: {
          key: 'error_performing_request',
        },
      })
    }

    const emailToCheck = sessionData.email

    try {
      await checkConfirmCodeRateLimiter.consume(emailToCheck, 1, {
        method: 'email',
      })
    } catch (err) {
      if (err?.remainingPoints === 0) {
        return res.sendStatus(429)
      } else {

View on GitHub (pinned to 28ad3b03b7)

Solutions

1. Return a 422 prompting the user to restart the email confirmation flow
2. Check for session store churn or cookie loss if this fires for users mid-flow
3. Make the frontend send users back to the 'add email' step when this response arrives

When it happens

Trigger: Thrown at services/web/app/src/Features/User/UserEmailsController.mjs:195 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of overleaf/overleaf@28ad3b03b7 (2026-09-03). Data as JSON: /api/errors/cbee6d7e6a19e7a7. Report an issue: GitHub.