Bug #69127 [Ver]: session_regenerate_id(true) randomly generates a warning and loses session data

Edit report at https://bugs.php.net/bug.php?id=69127&edit=1 ID: 69127 Updated by: yohgaki@php.net Reported by: rbsimao at yahoo dot com dot br Summary: session_regenerate_id(true) randomly generates a warning and loses session data Status: Verified Type: Bug Package: Session related Operating System: Any PHP Version: Any Assigned To: yohgaki Block user comment: N Private report: N New Comment: Procedure to reproduce this issue test.php -------------- <?php ob_start(); session_start(); echo "<pre>"; var_dump(session_id(), $_SESSION['v']++); session_regenerate_id(true); var_dump(session_id()); ?> -------------- Start CLI server $ php -S 127.0.0.1:8888 Access test.php and press F5 few minutes http://127.0.0.1:8888/test.php You'll see counter value ($_SESSION['v']) is resetted sometimes. PHP 7.0 git + Fedora 22 + Chrome 45.0.2454.93 (64-bit) : Easy to reproduce. Thousands of requests are enough. PHP 7.0 git + Fedora 22 + Firefox 40.0.3 : Very hard to reproduce. Tens of thousands of requests are required. CLI server process requests one by one. The reason why there is difference would be how browser locks cookie data. It seems Chrome locking is more lazy or no locks at all. (BTW, even if browser locks cookie strictly, lost packet/etc could cause lost session. Therefore, "eventually consistent" approach is required for reliable HTTP session management.) Let me know if you(anyone) could reproduce the bug or not by this procedure - PHP version, OS name/version, Browser name/version and easiness/hardness of reproducibility. Previous Comments: ------------------------------------------------------------------------ [2015-05-24 06:22:13] yohgaki@php.net This bug is related to https://bugs.php.net/bug.php?id=65746 ------------------------------------------------------------------------ [2015-02-27 05:00:31] yohgaki@php.net This is known issue and I proposed fix for this. However, there are people who do not like my proposal. Since session data and browser is not synced, session module must handle session_regenerate_id(true) in async way. This is what I proposed before. I shall try to fix this again. Thank you for reporting. ------------------------------------------------------------------------ [2015-02-26 18:05:05] rbsimao at yahoo dot com dot br Description: ------------ --- From manual page: http://www.php.net/function.session-regenerate-id --- The piece of code below works ok most of the time. Randomly it does not work: session_regenerate_id(true) issues a warning saying it could not delete the old session data. But the session file is there and the permissions are untouched. Also, when it issues the warning, all the session data is lost on the new generated session. Tested on ubuntu11 to ubuntu14 with default phps and windows 7/php5.5. Test script: --------------- <?php session_start(); session_regenerate_id(true); session_write_close(); ?> ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=69127&edit=1