# Internet Identity: null session-delegation record causes authorization failure for a specific identity

**URL:** <https://forum.dfinity.org/t/internet-identity-null-session-delegation-record-causes-authorization-failure-for-a-specific-identity/75121>\
**Category:** internet-identity\
**Created:** [August 15, 2026, 10:47pm UTC](https://forum.dfinity.org/t/internet-identity-null-session-delegation-record-causes-authorization-failure-for-a-specific-identity/75121 "2026-08-15T22:47:45Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![hude](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/hude/32/12818_2.png) [@hude](https://forum.dfinity.org/u/hude)\
**Post date:** [August 15, 2026, 10:47pm UTC](https://forum.dfinity.org/t/internet-identity-null-session-delegation-record-causes-authorization-failure-for-a-specific-identity/75121/1 "2026-08-15T22:47:45Z")

</div>

I opened [dfinity/internet-identity#4163](https://github.com/dfinity/internet-identity/issues/4163) for this error:

```plaintext
Unexpected error
null is not an object (evaluating 'r.expiresAtMillis')

```

This appears to be affecting multiple users.

After looking through the current Internet Identity frontend code, the immediate cause appears to be a missing `null` check in `actorForIdentity()`.

The session-delegation record is loaded from IndexedDB here:

```ts
record = await idbGet<SessionDelegationRecord>(
  identityNumber.toString(),
  SESSION_DELEGATION_STORE,
);

if (record === undefined) {
  return undefined;
}

if (record.expiresAtMillis - EXPIRY_MARGIN_MS <= Date.now()) {
  void purgeSession(identityNumber);
  return undefined;
}

```

The code handles `undefined`, but not `null`.

If `idbGet()` returns `null`, the `undefined` check is bypassed and the next line immediately dereferences:

```ts
record.expiresAtMillis

```

which matches the reported error exactly:

```plaintext
null is not an object (evaluating 'r.expiresAtMillis')

```

This also explains why the problem can persist. The exception occurs before the invalid session-delegation record can be purged, so the same broken state can be hit again on subsequent authorization attempts.

The behavior is also identity-specific because the IndexedDB session-delegation store is keyed by:

```ts
identityNumber.toString()

```

With an affected Internet Identity selected, authorization fails, while switching to another Internet Identity in the same browser can allow authorization to proceed normally.

I also checked whether the multiple-account functionality might be involved. “Show all options” can be OFF and the error still occurs. Attempting to enable “Show all options” produces the same `expiresAtMillis` error.

That is consistent with the code because both the normal default-account path and the account-list path use the same `actorForIdentity()` session-delegation lookup.

So the common failure point appears to be the browser-side session-delegation lookup in `actorForIdentity()`, specifically the assumption that the IndexedDB result can only be a valid `SessionDelegationRecord` or `undefined`, while `null` is not handled.

---

<div class="post-metadata">

**Author:** ![hude](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/hude/32/12818_2.png) [@hude](https://forum.dfinity.org/u/hude)\
**Post date:** [August 28, 2026, 3:50am UTC](https://forum.dfinity.org/t/internet-identity-null-session-delegation-record-causes-authorization-failure-for-a-specific-identity/75121/2 "2026-08-28T03:50:03Z")

</div>

@sea-snake @aterga Could you please take a look at this issue when you have a chance?

---

<div class="post-metadata">

**Author:** ![sea-snake](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/sea-snake/32/7243_2.png) [@sea-snake](https://forum.dfinity.org/u/sea-snake)\
**Post date:** [August 30, 2026, 9:52am UTC](https://forum.dfinity.org/t/internet-identity-null-session-delegation-record-causes-authorization-failure-for-a-specific-identity/75121/3 "2026-08-30T09:52:46Z")

</div>

This is fixed in this week’s release, proposal is expected to be executed on Monday: [https://forum.dfinity.org/t/proposal-143740-to-upgrade-ii/75387?u=sea-snake](https://forum.dfinity.org/t/proposal-143740-to-upgrade-ii/75387)

---

<div class="post-metadata">

**Author:** ![hude](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/hude/32/12818_2.png) [@hude](https://forum.dfinity.org/u/hude)\
**Post date:** [August 31, 2026, 12:17am UTC](https://forum.dfinity.org/t/internet-identity-null-session-delegation-record-causes-authorization-failure-for-a-specific-identity/75121/4 "2026-08-31T00:17:00Z")

</div>

Thank you for fixing the issue.  
I should be able to share some good news with the users.