System.NullReferenceException at at Duende.IdentityServer.Services.DefaultSessionCoordinationService.ProcessExpirationAsync

[prijgec]

We are getting multiple errors in our backend error logs from ProcessExpirationAsync. Can a null check be added for session before getting clientid?

Category: Microsoft.Extensions.DependencyInjection.ServerSideSessionCleanupHost　

Exception removing expired sessions

Exception:

System.NullReferenceException: Object reference not set to an instance of an object.

at Duende.IdentityServer.Services.DefaultSessionCoordinationService.ProcessExpirationAsync(UserSession session) in /_/src/IdentityServer/Services/Default/DefaultSessionCoordinationService.cs:line 138

at Microsoft.Extensions.DependencyInjection.ServerSideSessionCleanupHost.RunAsync(CancellationToken cancellationToken) in /_/src/IdentityServer/Hosting/ServerSideSessionCleanupHost.cs:line 148

[RolandGuijt]

This can happen if the client is deleted while it still has open sessions. Could that be the situation in your case?
If so is there any particular reason the client is deleted while there are still dependencies?
Are you using the default entity framework store?

[prijgec]

There is no deleted client scenario in our case, yes, we are using default entity framework.

[id-adesso]

we have the same problem. The DefaultSessionCoordinationService handles it properly in ProcessLogoutAsync here, but this check is missing in ProcessExpirationAsync

[maartenba]

Thanks folks for reporting! A fix is ready (DuendeSoftware/products#2038) and will go in the next bugfix release.