A session the console cannot decode answers the error page on every request until it expires #262

New Issue

2026-10-24T06:52:45Z

cgalo5758 commented

2026-10-24 06:52:45 +00:00

What happens

The session layer (auth.Config.LoadAndSave over the scs session manager) runs on every route except /static/, /favicon.ico, /domains/ask and the webhook endpoints. When the session store returns a value the session codec cannot decode (an empty, truncated or corrupted value, or one written in another format), scs hands the error to sessionErrorFunc (internal/auth/session_store.go) before any handler runs. sessionErrorFunc logs "session could not be decoded or encoded", deletes the response's Set-Cookie header, and answers the styled 500 page ("An unexpected error occurred. Try again."). The stored value stays in the store and the cookie stays in the browser.

Every later request that carries the cookie, /login and /logout included, reads the same value and answers the same 500, until the stored session or the cookie expires: up to the session lifetime of seven days. Trying again cannot help; clearing the site's cookies in the browser is the only way out. TestUndecodableSessionAnswers500 in internal/auth/session_store_test.go pins the current answer.

What should happen

A session the codec cannot decode is treated as no session: the stored value is deleted, the request continues signed out with a fresh session cookie (a page that needs sign-in sends the person to sign in), and the failure is logged.

Where

internal/auth/session_store.go (sessionErrorFunc)

Steps

Sign in to the console.
Replace the session's stored value with bytes the codec cannot decode: in Valkey, SET scs:session:<value of the session cookie> x KEEPTTL.
Load any page, then /logout: each answers the 500 error page, and so does every later request.

Why it matters

A person whose stored session goes bad is locked out of the console, signing out included, for up to a week, while the page tells them to try again.

### What happens The session layer (`auth.Config.LoadAndSave` over the `scs` session manager) runs on every route except `/static/`, `/favicon.ico`, `/domains/ask` and the webhook endpoints. When the session store returns a value the session codec cannot decode (an empty, truncated or corrupted value, or one written in another format), `scs` hands the error to `sessionErrorFunc` (`internal/auth/session_store.go`) before any handler runs. `sessionErrorFunc` logs "session could not be decoded or encoded", deletes the response's `Set-Cookie` header, and answers the styled 500 page ("An unexpected error occurred. Try again."). The stored value stays in the store and the cookie stays in the browser. Every later request that carries the cookie, `/login` and `/logout` included, reads the same value and answers the same 500, until the stored session or the cookie expires: up to the session lifetime of seven days. Trying again cannot help; clearing the site's cookies in the browser is the only way out. `TestUndecodableSessionAnswers500` in `internal/auth/session_store_test.go` pins the current answer. ### What should happen A session the codec cannot decode is treated as no session: the stored value is deleted, the request continues signed out with a fresh session cookie (a page that needs sign-in sends the person to sign in), and the failure is logged. ### Where `internal/auth/session_store.go` (`sessionErrorFunc`) ### Steps 1. Sign in to the console. 2. Replace the session's stored value with bytes the codec cannot decode: in Valkey, `SET scs:session:<value of the session cookie> x KEEPTTL`. 3. Load any page, then `/logout`: each answers the 500 error page, and so does every later request. ### Why it matters A person whose stored session goes bad is locked out of the console, signing out included, for up to a week, while the page tells them to try again.

cgalo5758 added the

kind

bug

area/identity labels 2026-10-24 06:52:45 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: wiki-cafe/member-console#262