The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

middleware/session/session.go (1)

373-398: Bug: getExtractorInfo omits SourceAuthHeader (breaks auth‑header extractors).

You include SourceAuthHeader in setSession/delSession but filter it out here, so Authorization won’t be set/cleared. Include it alongside header/cookie.

-   // If it's a chained extractor, collect all cookie/header extractors
+   // If it's a chained extractor, collect all cookie/header/auth-header extractors
    if len(extractor.Chain) > 0 {
        for _, chainExtractor := range extractor.Chain {
-           if chainExtractor.Source == extractors.SourceCookie || chainExtractor.Source == extractors.SourceHeader {
+           if chainExtractor.Source == extractors.SourceCookie ||
+              chainExtractor.Source == extractors.SourceHeader ||
+              chainExtractor.Source == extractors.SourceAuthHeader {
                relevantExtractors = append(relevantExtractors, chainExtractor)
            }
        }
-   } else if extractor.Source == extractors.SourceCookie || extractor.Source == extractors.SourceHeader {
+   } else if extractor.Source == extractors.SourceCookie ||
+             extractor.Source == extractors.SourceHeader ||
+             extractor.Source == extractors.SourceAuthHeader {
        // Single extractor - only include if it's cookie or header
        relevantExtractors = append(relevantExtractors, extractor)
    }

docs/middleware/session.md (2)

296-298: Fix markdownlint (MD034, MD032) and avoid a possibly non-existent guide link.

Convert the bare URL to a markdown link and remove the lone list item.

-This middleware uses the shared extractors module for session ID extraction. See the Extractors Guide:
-- https://docs.gofiber.io/guide/extractors
+This middleware uses the shared extractors module for session ID extraction. See the [Extractors Guide](https://docs.gofiber.io/guide/extractors).

---

402-413: Custom read‑only extractor should set a non‑writing Source.

Without Source, zero‑value may default to a writing source, contradicting “read‑only” intent. Also, the function name suggests a param, but it reads a header.

 func FromCustomParam() extractors.Extractor {
     return extractors.Extractor{
         Extract: func(c fiber.Ctx) (string, error) {
             sessionID := c.Get("X-Custom-Session")
             if sessionID == "" {
                 return "", extractors.ErrNotFound
             }
             return sessionID, nil
         },
-        // Read-only, won't set responses (non-header/cookie source)
+        // Read-only: do not set any response values
+        Source: extractors.SourceOther,
         Key:    "X-Custom-Session",
     }
 }

middleware/session/store.go (1)

188-189: Nit: reference the exact package path in the doc comment.

Clarify where the extractor comes from to aid grep-ability and IDE tooltips.

-// The extractor is provided by the shared extractors package.
+// The extractor is provided by github.com/gofiber/fiber/v3/extractors.

middleware/session/session_test.go (1)

11-11: Tests migrated to external extractors — consider adding coverage for Authorization extractor.

Current suite doesn’t validate SourceAuthHeader write/cleanup behavior. Add a focused test to guard it.

Would you like me to open a follow‑up PR with such a test?

Also applies to: 537-538, 567-568, 600-601, 633-634, 665-666, 868-869

middleware/session/session.go (1)

409-414: Auth header formatting: consider prefixing with “Bearer ” when writing Authorization.

If ext.Source == SourceAuthHeader, most clients expect “Authorization: Bearer ”. Today you set the raw ID, which may be surprising.

-   case extractors.SourceHeader, extractors.SourceAuthHeader:
-       s.ctx.Response().Header.SetBytesV(ext.Key, []byte(s.id))
+   case extractors.SourceAuthHeader:
+       s.ctx.Response().Header.Set(ext.Key, "Bearer "+s.id)
+   case extractors.SourceHeader:
+       s.ctx.Response().Header.SetBytesV(ext.Key, []byte(s.id))

And similarly on delete it’s fine to just Del the header (no format needed). If you prefer not to set Authorization at all in responses, alternatively drop SourceAuthHeader from the writable set and document it as read‑only.

Also applies to: 446-452

docs/middleware/session.md (1)

378-397: Avoid echoing Authorization header back to clients.

Setting Source: SourceHeader will cause the middleware to write the Authorization header in responses (token leak risk). Make this extractor read‑only.

-        Source: extractors.SourceHeader, // This will set response headers
+        Source: extractors.SourceOther,  // Read-only; do NOT echo Authorization

-app.Use(session.New(session.Config{
-    Extractor: FromAuthorization(), // Will set Authorization header in response
-}))
+app.Use(session.New(session.Config{
+    Extractor: FromAuthorization(), // Read-only; no response header is set
+}))

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Learnt from: sixcolors
PR: gofiber/fiber#3625
File: middleware/session/config.go:57-58
Timestamp: 2025-07-27T17:28:53.403Z
Learning: In the session middleware `Config` struct, the `Extractor` field uses function closures (like `FromCookie(key)`), making it impossible to introspect extractor parameters at runtime for validation purposes without complex reflection techniques.

Learnt from: sixcolors
PR: gofiber/fiber#3051
File: middleware/session/session.go:215-216
Timestamp: 2024-10-08T19:06:06.583Z
Learning: Parallel tests for `Session.Save` already exist in the `middleware/session/session_test.go` file, specifically in the `Test_Session_Save` and `Test_Session_Save_Expiration` functions.

Learnt from: sixcolors
PR: gofiber/fiber#3016
File: middleware/session/config.go:16-26
Timestamp: 2024-10-08T19:06:06.583Z
Learning: In the session middleware `Config` struct, `Store` is backed by `fiber.Storage`; they are different entities serving distinct purposes in session management.

Learnt from: sixcolors
PR: gofiber/fiber#3016
File: middleware/session/store.go:164-167
Timestamp: 2024-10-08T19:06:06.583Z
Learning: Unit tests in this project use testify require.

Learnt from: sixcolors
PR: gofiber/fiber#2922
File: middleware/cors/utils.go:63-71
Timestamp: 2024-10-08T19:06:06.583Z
Learning: The project uses the testify/assert package for assertions in unit tests.

Learnt from: efectn
PR: gofiber/fiber#3162
File: hooks_test.go:228-228
Timestamp: 2024-12-13T08:14:22.851Z
Learning: In Go test files, prefer using the `require` methods from the `testify` package for assertions instead of manual comparisons and calls to `t.Fatal` or `t.Fatalf`.

Learnt from: sixcolors
PR: gofiber/fiber#3625
File: middleware/session/config.go:57-58
Timestamp: 2025-07-27T17:28:53.403Z
Learning: In the session middleware `Config` struct, the `Extractor` field uses function closures (like `FromCookie(key)`), making it impossible to introspect extractor parameters at runtime for validation purposes without complex reflection techniques.

Learnt from: ReneWerner87
PR: gofiber/fiber#3161
File: app.go:923-932
Timestamp: 2024-11-15T07:56:21.623Z
Learning: In the Fiber framework, breaking changes are acceptable when moving from version 2 to version 3, including modifications to method signatures such as in the `Test` method in `app.go`.

Learnt from: sixcolors
PR: gofiber/fiber#3016
File: middleware/csrf/session_manager.go:30-43
Timestamp: 2024-09-25T16:15:39.392Z
Learning: In the session middleware, `session.FromContext(c)` returns `*session.Middleware`, whereas `m.session.Get(c)` returns `*session.Store`, so they are not directly interchangeable.

Learnt from: sixcolors
PR: gofiber/fiber#3016
File: middleware/csrf/csrf_test.go:164-165
Timestamp: 2024-10-08T19:06:06.583Z
Learning: In the `Test_CSRF_WithSession_Middleware` function, calling `session.NewWithStore()` without arguments is acceptable, as the default configuration is sufficient.

Learnt from: sixcolors
PR: gofiber/fiber#3016
File: middleware/session/config.go:26-26
Timestamp: 2024-10-08T19:06:06.583Z
Learning: In the session middleware, the `newStore`, `New`, and `NewWithStore` functions ensure that a `Store` is present even if it is not initialized in `ConfigDefault`.

docs/middleware/session.md (2)

627-634: Link to Extractors Guide is helpful.

Assuming docs are live, this cross‑ref is great. If there’s any chance of delay, consider a brief fallback note.

---

400-413: Custom read‑only extractor is missing Source; defaults may write headers.

Explicitly mark it as custom to avoid unintended response writes.

Apply:

 func FromCustomParam() extractors.Extractor {
     return extractors.Extractor{
         Extract: func(c fiber.Ctx) (string, error) {
             sessionID := c.Get("X-Custom-Session")
             if sessionID == "" {
                 return "", extractors.ErrNotFound
             }
             return sessionID, nil
         },
-        // Read-only, won't set responses (non-header/cookie source)
+        // Read-only: non-header/cookie source
+        Source: extractors.SourceCustom,
         Key:    "X-Custom-Session",
     }
 }

docs/middleware/session.md (2)

70-71: Clarify __Host- cookie requirements in the production snippet.

__Host- cookies must be Secure, have Path="/" and no Domain.

Apply:

 app.Use(session.New(session.Config{
     Storage:           storage,
     CookieSecure:      true,              // HTTPS only
     CookieHTTPOnly:    true,              // Prevent XSS
     CookieSameSite:    "Lax",             // CSRF protection
     IdleTimeout:       30 * time.Minute,  // Session timeout
     AbsoluteTimeout:   24 * time.Hour,    // Maximum session life
     Extractor:         extractors.FromCookie("__Host-session_id"),
+    CookiePath:        "/",               // __Host- requires Path="/"
+    CookieDomain:      "",                // __Host- must NOT set Domain
 }))

---

702-716: Add the missing Config.Store property to the table.

Docs show examples using Store, but the reference table omits it.

Apply:

 | `Storage`           | `fiber.Storage`             | Session storage backend     | `memory.New()`                             |
+| `Store`             | `*session.Store`            | Prebuilt store (overrides Storage) | `nil`                               |
 | `Extractor`         | `extractors.Extractor`      | Session ID extraction       | `extractors.FromCookie("session_id")`     |

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Learnt from: sixcolors
PR: gofiber/fiber#3625
File: middleware/session/config.go:57-58
Timestamp: 2025-07-27T17:28:53.403Z
Learning: In the session middleware `Config` struct, the `Extractor` field uses function closures (like `FromCookie(key)`), making it impossible to introspect extractor parameters at runtime for validation purposes without complex reflection techniques.

Learnt from: sixcolors
PR: gofiber/fiber#3016
File: middleware/session/config.go:16-26
Timestamp: 2024-09-25T16:17:00.969Z
Learning: In the session middleware `Config` struct, `Store` is backed by `fiber.Storage`; they are different entities serving distinct purposes in session management.

Learnt from: sixcolors
PR: gofiber/fiber#3016
File: middleware/session/config.go:16-26
Timestamp: 2024-10-08T19:06:06.583Z
Learning: In the session middleware `Config` struct, `Store` is backed by `fiber.Storage`; they are different entities serving distinct purposes in session management.

Learnt from: sixcolors
PR: gofiber/fiber#3625
File: middleware/session/config.go:57-58
Timestamp: 2025-07-27T17:28:53.403Z
Learning: In the session middleware `Config` struct, the `Extractor` field uses function closures (like `FromCookie(key)`), making it impossible to introspect extractor parameters at runtime for validation purposes without complex reflection techniques.

Learnt from: sixcolors
PR: gofiber/fiber#3016
File: middleware/session/store.go:164-167
Timestamp: 2024-10-02T23:03:31.727Z
Learning: Unit tests in this project use testify require.

Learnt from: sixcolors
PR: gofiber/fiber#3016
File: middleware/session/config.go:16-26
Timestamp: 2024-10-08T19:06:06.583Z
Learning: In the session middleware `Config` struct, `Store` is backed by `fiber.Storage`; they are different entities serving distinct purposes in session management.

Learnt from: sixcolors
PR: gofiber/fiber#3016
File: middleware/csrf/session_manager.go:30-43
Timestamp: 2024-09-25T16:15:39.392Z
Learning: In the session middleware, `session.FromContext(c)` returns `*session.Middleware`, whereas `m.session.Get(c)` returns `*session.Store`, so they are not directly interchangeable.

Learnt from: sixcolors
PR: gofiber/fiber#3051
File: middleware/session/session.go:215-216
Timestamp: 2024-06-30T00:38:06.580Z
Learning: The `session.Save()` method in the `middleware/session` package returns the `Session` back to `sync.Pool`.

Learnt from: sixcolors
PR: gofiber/fiber#3016
File: middleware/csrf/csrf_test.go:164-165
Timestamp: 2024-10-08T19:06:06.583Z
Learning: In the `Test_CSRF_WithSession_Middleware` function, calling `session.NewWithStore()` without arguments is acceptable, as the default configuration is sufficient.

Learnt from: sixcolors
PR: gofiber/fiber#3016
File: middleware/session/config.go:26-26
Timestamp: 2024-10-08T19:06:06.583Z
Learning: In the session middleware, the `newStore`, `New`, and `NewWithStore` functions ensure that a `Store` is present even if it is not initialized in `ConfigDefault`.

middleware/session/session.go (7)

372-398: Clarify intent: exclude Authorization extractors from response-setting logic.

getExtractorInfo currently returns only cookie and non-Authorization header extractors (by checking only SourceCookie and SourceHeader). That matches the “read‑only Authorization” policy, but the comment “returns all cookie and header extractors” can be misread to include SourceAuthHeader. Please make the comment explicit to avoid regressions and bot noise.

-// getExtractorInfo returns all cookie and header extractors from the chain
+// getExtractorInfo returns cookie and non-Authorization header extractors from the chain

---

405-433: Make SourceAuthHeader handling explicit (read‑only).

Behavior is correct (do nothing), but an explicit case improves readability and prevents future regressions if default handling changes.

 		for _, ext := range relevantExtractors {
 			switch ext.Source {
 			case extractors.SourceHeader:
 				s.ctx.Response().Header.SetBytesV(ext.Key, []byte(s.id))
+			case extractors.SourceAuthHeader:
+				// Read-only for sessions: do not set Authorization on response
 			case extractors.SourceCookie:

---

441-469: Mirror explicit SourceAuthHeader handling in deletion.

Same rationale as in set path: make read‑only intent obvious.

 		for _, ext := range relevantExtractors {
 			switch ext.Source {
 			case extractors.SourceHeader:
 				s.ctx.Request().Header.Del(ext.Key)
 				s.ctx.Response().Header.Del(ext.Key)
+			case extractors.SourceAuthHeader:
+				// Read-only for sessions: do not modify Authorization headers
 			case extractors.SourceCookie:

---

516-541: Fix encodeSessionData docstring (no parameters).

The doc references a non-existent parameter and wrong usage.

-// encodeSessionData encodes session data to raw bytes
-//
-// Parameters:
-//   - rawData: The raw byte data to encode.
-//
-// Returns:
-//   - error: An error if the encoding fails.
-//
-// Usage:
-//
-//	// err := s.encodeSessionData(rawData)
+// encodeSessionData encodes session data to raw bytes.
+//
+// Returns:
+//   - []byte, error: Encoded bytes or an error.
+//
+// Usage:
+//
+//	b, err := s.encodeSessionData()

---

571-581: Correct usage example name.

The method is setAbsExpiration.

-//	s.setExpiration(time.Now().Add(time.Hour))
+//	s.setAbsExpiration(time.Now().Add(time.Hour))

---

445-465: Nit: simplify duration expression.

time.Now().Add(-1 * time.Minute) can be time.Now().Add(-time.Minute).

---

310-341: Invariant validated — s.config is set before saveSession(), but harden the code

• Evidence: Store.getSession and Store.GetByID both assign sess.config before returning (middleware/session/store.go:152, 291). releaseSession clears ctx and config (middleware/session/session.go:89–96). middleware.saveSession calls Session.saveSession() before release, and Session.Save skips saving when the middleware owns the session. Current call paths therefore guarantee s.config != nil when saveSession() runs.

• Recommendation: add defensive nil-check(s) (or avoid returning a default extractor when config==nil) before dereferencing s.config in saveSession()/setSession()/delSession() to remove the brittle invariant.

docs/middleware/session.md (2)

63-77: Add __Host- cookie requirements note.

You use __Host- in the example. Browsers require: Secure=true, Path=/, and no Domain attribute. Add a bullet so users don’t accidentally set CookieDomain.

 Notes:
 
 - AbsoluteTimeout must be greater than or equal to IdleTimeout; otherwise, the middleware panics during configuration.
 - If CookieSameSite is set to "None", the middleware automatically forces CookieSecure=true when setting the cookie.
+- When using the "__Host-" cookie prefix, do not set CookieDomain, set CookiePath="/" and ensure CookieSecure=true; otherwise browsers will reject the cookie.

---

300-331: Explicitly call out non‑mutating sources.

Good section. Consider tightening wording to “non‑Authorization headers” here too for consistency with code behavior.

-**Session Response Behavior:**
+**Session Response Behavior:**

-- Cookie extractors: set cookie in the response
-- Header extractors (non-Authorization): set header in the response
-- Authorization header, Query, Form, Param, Custom: read-only (no response values are set)
+- Cookie extractors: set cookie in the response
+- Header extractors (non‑Authorization): set header in the response
+- Authorization header, Query, Form, Param, Custom: read‑only (no response values are set)

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Learnt from: sixcolors
PR: gofiber/fiber#3625
File: middleware/session/config.go:57-58
Timestamp: 2025-07-27T17:28:53.403Z
Learning: In the session middleware `Config` struct, the `Extractor` field uses function closures (like `FromCookie(key)`), making it impossible to introspect extractor parameters at runtime for validation purposes without complex reflection techniques.

Learnt from: sixcolors
PR: gofiber/fiber#3016
File: middleware/session/config.go:16-26
Timestamp: 2024-09-25T16:17:00.969Z
Learning: In the session middleware `Config` struct, `Store` is backed by `fiber.Storage`; they are different entities serving distinct purposes in session management.

Learnt from: sixcolors
PR: gofiber/fiber#3016
File: middleware/session/config.go:16-26
Timestamp: 2024-10-08T19:06:06.583Z
Learning: In the session middleware `Config` struct, `Store` is backed by `fiber.Storage`; they are different entities serving distinct purposes in session management.

Learnt from: sixcolors
PR: gofiber/fiber#3625
File: middleware/session/config.go:57-58
Timestamp: 2025-07-27T17:28:53.403Z
Learning: In the session middleware `Config` struct, the `Extractor` field uses function closures (like `FromCookie(key)`), making it impossible to introspect extractor parameters at runtime for validation purposes without complex reflection techniques.

Learnt from: sixcolors
PR: gofiber/fiber#3016
File: middleware/csrf/session_manager.go:30-43
Timestamp: 2024-09-25T16:15:39.392Z
Learning: In the session middleware, `session.FromContext(c)` returns `*session.Middleware`, whereas `m.session.Get(c)` returns `*session.Store`, so they are not directly interchangeable.

Learnt from: sixcolors
PR: gofiber/fiber#0
File: :0-0
Timestamp: 2025-09-14T00:10:40.520Z
Learning: The `session.Save()` method in the `middleware/session` package only persists session data to storage and updates the client cookie. It does NOT return the Session back to `sync.Pool`. The session remains valid and usable after calling Save().

Learnt from: sixcolors
PR: gofiber/fiber#3016
File: middleware/csrf/csrf_test.go:164-165
Timestamp: 2024-10-08T19:06:06.583Z
Learning: In the `Test_CSRF_WithSession_Middleware` function, calling `session.NewWithStore()` without arguments is acceptable, as the default configuration is sufficient.

Learnt from: sixcolors
PR: gofiber/fiber#3016
File: middleware/session/config.go:16-26
Timestamp: 2024-09-25T16:17:00.969Z
Learning: In the session middleware `Config` struct, `Store` is backed by `fiber.Storage`; they are different entities serving distinct purposes in session management.

Learnt from: sixcolors
PR: gofiber/fiber#3016
File: middleware/session/config.go:26-26
Timestamp: 2024-10-08T19:06:06.583Z
Learning: In the session middleware, the `newStore`, `New`, and `NewWithStore` functions ensure that a `Store` is present even if it is not initialized in `ConfigDefault`.