[php-src] PR #25433: ext/session: Fix new empty sessions never being stored with lazy_write and strict mode
| From: | jorgsowa | Date: | Thu, 12 Nov 2026 19:50:19 +0000 |
| Subject: | [php-src] PR #25433: ext/session: Fix new empty sessions never being stored with lazy_write and strict mode | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-40603@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/25433
Author: jorgsowa
Since 86b49211577, lazy_write calls updateTimestamp() instead of write() for a session that is read
as empty and stays empty. That includes a session whose ID was just created.
Many handlers, such as redis and memcached, only refresh existing records in
updateTimestamp(). With those handlers, a new empty session is never stored. With
session.use_strict_mode=1, which is now the default, the next request's ID fails
validateId() and a new ID is issued. The client gets a new session ID on every request
until something is written to the session.
Steps, with default settings:
1. A request without a cookie gets a new ID A. The session is empty, so
updateTimestamp(A) is called and A is never stored.
2. The next request sends A. validateId(A) fails, so a new ID B is issued, and step 1
repeats.
The fix skips the lazy_write comparison when the ID was created in the current request,
so a new session is written once, as in 8.5. Existing empty sessions still get
updateTimestamp(), so the fix for bug 71162 is kept.