Breaking change in 1.0.3: if `s.store.Get` returns an error, `Session()` returns `nil.`

[alan-anzenna]

s.store.Get() returns a new session when returning an error for gorilla session's CookieStore.

// Get returns a session for the given name after adding it to the registry.
//
// It returns a new session if the sessions doesn't exist. Access IsNew on
// the session to check if it is an existing session or a new one.
//
// It returns a new session and an error if the session exists but could
// not be decoded.

In 1.0.2, Session() would use this new session. In 1.0.3, Session() returns nil.

This behavior was changed here.

Most of the callers in sessions.go (such as ID()) are not written to handle Session() returning nil.

[twoNDchances]

oh my godness, i got the same error, it took me all night to find this bug and yah. hope to merge the new code soon

[wzxjohn]

I encountered the same issue. This breaking change will cause many problem. For example, if you try to get session value by this:

session := sessions.Default(c)
id := session.Get("id")

In the previous version, id will be nil, give you a chance to check it later.
But in the new version, session.Get will panic, and you will have no chance to check the result.
Modifying the SecretKey of CookieStore will inevitably trigger this issue.

[Laisky]

This change has terrible side effects.

[sunshineplan]

In some cases, I change the keyPairs for the cookie.NewStore function, which causes a “securecookie: the value is not valid” error as expected. However, I still need to operate on the session for re-login purposes. If sessions.Default(c) doesn’t return a session object, I have no way to proceed.

[wzxjohn]

If sessions.Default(c) doesn’t return a session object

Small mistake, sessions.Default(c) never returns nil, but the session object will panic during Get call.

[appleboy]

fixed in #289

[appleboy]

https://github.com/gin-contrib/sessions/releases/tag/v1.0.4