remix-run/remix · warning

Session ID ${session.deleteId} was regenerated, but the old

Error message

Session ID ${session.deleteId} was regenerated, but the old session cannot be deleted when using cookie storage

What it means

When using cookie-based session storage, the entire session lives in a single cookie, so there is no server-side record to delete. If a session ID is regenerated, the middleware warns that the old session cannot be explicitly deleted; the old data simply ages out with the cookie it was set in.

Source

Thrown at packages/session/src/lib/session-storage/cookie.ts:28

 * @returns The session storage
 */
export function createCookieSessionStorage(): SessionStorage {
  return {
    async read(cookie) {
      if (cookie) {
        try {
          let parsed = JSON.parse(cookie) as { i: string; d: SessionData }
          return createSession(parsed.i, parsed.d)
        } catch {
          // Invalid JSON, fall through to create new session
        }
      }

      return createSession()
    },
    async save(session) {
      if (session.deleteId) {
        console.warn(
          `Session ID ${session.deleteId} was regenerated, but the old session cannot ` +
            'be deleted when using cookie storage',
        )
      }

      if (session.destroyed) {
        return ''
      }
      if (session.dirty) {
        return JSON.stringify({ i: session.id, d: session.data })
      }

      return null
    },
  }
}

View on GitHub (pinned to 9696913134)

Solutions

1. Switch to a server-side session storage (e.g. database or Redis-backed createSessionStorage) if you need true old-session deletion on regeneration
2. Accept the warning for cookie storage: the old cookie is overwritten on save, so the risk is limited to in-flight copies
3. Regenerate before writing sensitive data so the old ID never holds privileged state

Example fix

// before
let storage = createCookieSessionStorage({ cookie: { secrets: ['s3cret'] } })
// after
let storage = createDatabaseSessionStorage(/* ... */)

const canDeleteSessions = storage.deleteSession !== undefined // server-backed storage

When it happens

Trigger: Calling session.regenerate() (or otherwise setting deleteId) on a session persisted with createCookieSessionStorage, then saving the session.

Common situations: Login flows that regenerate the session ID on privilege change (a common CSRF/session-fixation hardening step) while using cookie storage, which cannot honor the deletion.

Related errors

• csrf middleware requires session() middleware to run before
• Session is not started. Use session() middleware before csrf
• Session cookie must be signed
• Session cookie "${sessionCookie.name}" is configured with ht

AI-assisted analysis of remix-run/remix@9696913134 (2026-08-27). Data as JSON: /api/errors/26cf0984d809ea2f. Report an issue: GitHub.