Edit report at https://bugs.php.net/bug.php?id=69127&edit=1
ID: 69127
Updated by: yohgaki@php.net
Reported by: rbsimao at yahoo dot com dot br
Summary: session_regenerate_id(true) randomly generates a
warning and loses session data
-Status: Verified
+Status: Analyzed
Type: Bug
Package: Session related
Operating System: Any
PHP Version: Any
Assigned To: yohgaki
Block user comment: N
Private report: N
Previous Comments:
------------------------------------------------------------------------
[2015-09-29 02:07:14] yohgaki@php.net
Related RFC
https://wiki.php.net/rfc/precise_session_management
------------------------------------------------------------------------
[2015-09-19 23:41:17] yohgaki@php.net
Procedure to reproduce this issue
test.php
--------------
<?php
ob_start();
session_start();
echo "<pre>";
var_dump(session_id(),
$_SESSION['v']++);
session_regenerate_id(true);
var_dump(session_id());
?>
--------------
Start CLI server
$ php -S 127.0.0.1:8888
Access test.php and press F5 few minutes
http://127.0.0.1:8888/test.php
You'll see counter value ($_SESSION['v']) is resetted sometimes.
PHP 7.0 git + Fedora 22 + Chrome 45.0.2454.93 (64-bit) : Easy to reproduce. Thousands of requests
are enough.
PHP 7.0 git + Fedora 22 + Firefox 40.0.3 : Very hard to reproduce. Tens of thousands of requests are
required.
CLI server process requests one by one. The reason why there is difference would be how browser
locks cookie data. It seems Chrome locking is more lazy or no locks at all. (BTW, even if browser
locks cookie strictly, lost packet/etc could cause lost session. Therefore, "eventually
consistent" approach is required for reliable HTTP session management.)
Let me know if you(anyone) could reproduce the bug or not by this procedure - PHP version, OS
name/version, Browser name/version and easiness/hardness of reproducibility.
------------------------------------------------------------------------
[2015-05-24 06:22:13] yohgaki@php.net
This bug is related to
https://bugs.php.net/bug.php?id=65746
------------------------------------------------------------------------
[2015-02-27 05:00:31] yohgaki@php.net
This is known issue and I proposed fix for this.
However, there are people who do not like my proposal.
Since session data and browser is not synced, session module must handle session_regenerate_id(true)
in async way. This is what I proposed before.
I shall try to fix this again. Thank you for reporting.
------------------------------------------------------------------------
[2015-02-26 18:05:05] rbsimao at yahoo dot com dot br
Description:
------------
---
From manual page: http://www.php.net/function.session-regenerate-id
---
The piece of code below works ok most of the time. Randomly it does not work:
session_regenerate_id(true) issues a warning saying it could not delete the old session data. But
the session file is there and the permissions are untouched. Also, when it issues the warning, all
the session data is lost on the new generated session.
Tested on ubuntu11 to ubuntu14 with default phps and windows 7/php5.5.
Test script:
---------------
<?php
session_start();
session_regenerate_id(true);
session_write_close();
?>
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=69127&edit=1