[php-src] PR #25433: ext/session: Fix new empty sessions never being stored with lazy_write and strict mode

From: Date: Thu, 12 Nov 2026 19:50:19 +0000
Subject: [php-src] PR #25433: ext/session: Fix new empty sessions never being stored with lazy_write and strict mode
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-40603@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/25433 Author: jorgsowa Since 86b49211577, lazy_write calls updateTimestamp() instead of write() for a session that is read as empty and stays empty. That includes a session whose ID was just created. Many handlers, such as redis and memcached, only refresh existing records in updateTimestamp(). With those handlers, a new empty session is never stored. With session.use_strict_mode=1, which is now the default, the next request's ID fails validateId() and a new ID is issued. The client gets a new session ID on every request until something is written to the session. Steps, with default settings: 1. A request without a cookie gets a new ID A. The session is empty, so updateTimestamp(A) is called and A is never stored. 2. The next request sends A. validateId(A) fails, so a new ID B is issued, and step 1 repeats. The fix skips the lazy_write comparison when the ID was created in the current request, so a new session is written once, as in 8.5. Existing empty sessions still get updateTimestamp(), so the fix for bug 71162 is kept.

« previous php.git-pulls (#40603) next »