Re: SessionHandlerInterface protocol

On 23.06.2021 at 09:08, Mathieu Dubois wrote: > Dear list, > > I'm trying to understand PHP session handlers and more precisely the > return value of SessionHandlerInterface::read. > > The doc [1] states (emphasis mine): > >    Returns an encoded string of the read data. *If nothing was read, it >    must return false*. Note this value is returned internally to PHP >    for processing. > > However, the example used in the documentation of the SessionHandler > class [2] and other implementations (for instance Symfony's > PdoSessionHandler [3]) seem to return an empty string when nothing can > be read. > > If I understand well, the first time you connect to an host, nothing can > be read. My own test seems to indicate that returning false in this case > triggers an error while returning an empty string creates a new session. > > Can someone clarify this ? How is the value false used ? More generally, > I haven't found a clear explanation of which method is called at which > time during session creation and how the values are used. > > Note that I have posted the same question on SO [4] but I'm not > satisfied by the answers. > > Thanks in advance, > Mathieu > >   [1] > https://www.php.net/manual/en/sessionhandlerinterface.read.php >   [2] https://www.php.net/manual/en/class.sessionhandler >   [3] > > https://github.com/symfony/symfony/blob/c71c8727cc665c9e9b56e299fcfcc0adfbf02bac/src/Symfony/Component/HttpFoundation/Session/Storage/Handler/PdoSessionHandler.php#L638 > >   [4] https://stackoverflow.com/questions/68025570 Before ::read() is called, open() is called. ::open() is suppossed to create the empty session data, if no data for the given session exist. This empty data string should then be returned from ::read(). If ::read() fails to read the data, it should return false (or actually any non-string value in the current implementation) to signal failure. Christoph