🐛 [Bug]: Session middleware panics on store errors — server crash on Redis failure

[pageton]

Bug Description

The session middleware explicitly panics when Store.getSession() fails. In production, session store failures (Redis down, network partition, database timeout) are realistic scenarios that should return an error, not crash the server.

How to Reproduce

Steps to reproduce the behavior:

1. Configure session middleware with a Redis store
2. Stop the Redis server
3. Send any request
4. cfg.Store.getSession(c) returns an error
5. panic(err) crashes the server

Affected Code

middleware/session/middleware.go:149:

session, err := cfg.Store.getSession(c)
if err != nil {
    panic(err) // handle or log this error appropriately in production
}

The comment literally acknowledges the deficiency.

Expected Behavior

Return the error instead of panicking:

session, err := cfg.Store.getSession(c)
if err != nil {
    return fmt.Errorf("session: failed to get session: %w", err)
}

Related

• 🐛 [Bug]: No panic recovery in defaultRequestHandler — one handler crash kills the server #4339 — No panic recovery in defaultRequestHandler (same crash class)

Fiber Version

v3 (latest main branch)