overleaf/overleaf · error

error resending confirmation code. missing ${sessionKey}

Error message

error resending confirmation code. missing ${sessionKey}

What it means

Guard in the _resendConfirmationCode closure factory: req.session[sessionKey] is absent, so there is no pending confirmation whose code could be resent. It fires when a user hits the resend endpoint directly without a preceding send-code request (or after session expiry), with sessionKey naming the affected flow.

Source

Thrown at services/web/app/src/Features/User/UserEmailsController.mjs:330

const checkExistingEmailConfirmationCode = _checkConfirmationCode(
  'pendingExistingEmail',
  async (req, user, email) => {
    await UserAuditLogHandler.promises.addEntry(
      user._id,
      'confirm-email-via-code',
      user._id,
      req.ip,
      { email }
    )
  }
)

const _resendConfirmationCode =
  (sessionKey, operation, auditLogEmailKey) => async (req, res) => {
    const sessionData = req.session[sessionKey]
    if (!sessionData) {
      logger.err({}, `error resending confirmation code. missing ${sessionKey}`)
      return res.status(422).json({
        message: {
          key: 'error_performing_request',
        },
      })
    }

    const email = sessionData.email

    try {
      await resendConfirmCodeRateLimiter.consume(email, 1, { method: 'email' })
    } catch (err) {
      if (err?.remainingPoints === 0) {
        return res.status(429).json({})
      } else {
        throw err
      }
    }

View on GitHub (pinned to 28ad3b03b7)

Solutions

1. Keep responding 422 so the client knows to restart the flow from the email-entry step
2. Investigate session loss (cookie flags, session store) if legitimate flows trigger it
3. Rate-limit the resend endpoint independently of this guard

When it happens

Trigger: Thrown at services/web/app/src/Features/User/UserEmailsController.mjs:330 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of overleaf/overleaf@28ad3b03b7 (2026-09-03). Data as JSON: /api/errors/9a5d31883a00342c. Report an issue: GitHub.