I opened dfinity/internet-identity#4163 for this error:
Unexpected error
null is not an object (evaluating 'r.expiresAtMillis')
This appears to be affecting multiple users.
After looking through the current Internet Identity frontend code, the immediate cause appears to be a missing null check in actorForIdentity().
The session-delegation record is loaded from IndexedDB here:
record = await idbGet<SessionDelegationRecord>(
identityNumber.toString(),
SESSION_DELEGATION_STORE,
);
if (record === undefined) {
return undefined;
}
if (record.expiresAtMillis - EXPIRY_MARGIN_MS <= Date.now()) {
void purgeSession(identityNumber);
return undefined;
}
The code handles undefined, but not null.
If idbGet() returns null, the undefined check is bypassed and the next line immediately dereferences:
record.expiresAtMillis
which matches the reported error exactly:
null is not an object (evaluating 'r.expiresAtMillis')
This also explains why the problem can persist. The exception occurs before the invalid session-delegation record can be purged, so the same broken state can be hit again on subsequent authorization attempts.
The behavior is also identity-specific because the IndexedDB session-delegation store is keyed by:
identityNumber.toString()
With an affected Internet Identity selected, authorization fails, while switching to another Internet Identity in the same browser can allow authorization to proceed normally.
I also checked whether the multiple-account functionality might be involved. “Show all options” can be OFF and the error still occurs. Attempting to enable “Show all options” produces the same expiresAtMillis error.
That is consistent with the code because both the normal default-account path and the account-list path use the same actorForIdentity() session-delegation lookup.
So the common failure point appears to be the browser-side session-delegation lookup in actorForIdentity(), specifically the assumption that the IndexedDB result can only be a valid SessionDelegationRecord or undefined, while null is not handled.