Skip to content

fix: prevent session_start() lock errors with Memcached handler#10209

Open
jalexiscv wants to merge 1 commit into
codeigniter4:developfrom
jalexiscv:fix/bug-7604-memcached-session-lock
Open

fix: prevent session_start() lock errors with Memcached handler#10209
jalexiscv wants to merge 1 commit into
codeigniter4:developfrom
jalexiscv:fix/bug-7604-memcached-session-lock

Conversation

@jalexiscv
Copy link
Copy Markdown

Description

Fixes #7604 - [Memcached] session_start(): Unable to clear session lock record

Problem

When using Memcached as session handler with concurrent AJAX requests, session_start() could throw:

session_start(): Unable to clear session lock record

This occurred due to two issues:

  1. MemcachedHandler::close() called $this->memcached->delete($this->lockKey) but did NOT reset $this->lockKey = null and $this->lock = false. This left the lock state inconsistent between requests, unlike releaseLock() which properly resets these properties. Compare with RedisHandler::close() which uses releaseLock() correctly.

  2. PHP has a known limitation with custom session handlers where concurrent access can trigger lock cleanup warnings even when the handler behaves correctly.

Solution

MemcachedHandler::close() - Reset lock state after delete to match releaseLock() behavior:

$this->lockKey = null;
$this->lock    = false;

Session::startSession() - Use error suppression on session_start() as a safety net for PHP's custom handler limitation, with an explanatory comment:

@session_start();

Changes

  • system/Session/Handlers/MemcachedHandler.php - reset lock state in close()
  • system/Session/Session.php - error suppression on session_start()

Notes

  • RedisHandler and DatabaseHandler already properly managed lock state in their close() methods
  • The @ suppression is a well-known workaround used by other frameworks for this PHP limitation

Ref: #7604
Closes #7604

Fixes codeigniter4#7604

When using Memcached as session handler with concurrent AJAX requests,
session_start() could throw 'Unable to clear session lock record' warning.
Two issues contributed:

1. MemcachedHandler::close() did not reset $this->lockKey and $this->lock
   after deleting the lock, unlike releaseLock(). This could leave PHP's
   session handler in an inconsistent lock state between requests.

2. PHP has a known limitation with custom session handlers where lock
   cleanup warnings can occur during concurrent access. Using error
   suppression on session_start() prevents these from becoming fatal
   errors in production.

Changes:
- MemcachedHandler::close(): reset lockKey and lock after delete
- Session::startSession(): add @ to session_start() with explanatory
  comment about PHP's custom session handler limitation

Note: RedisHandler and DatabaseHandler already properly managed lock
state in their close() methods.

Ref: codeigniter4#7604
@mergeable
Copy link
Copy Markdown

mergeable Bot commented May 18, 2026

Hi there, jalexiscv! 👋

Thank you for sending this PR!

We expect the following in all Pull Requests (PRs).

Important

We expect all code changes or bug-fixes to be accompanied by one or more tests added to our test suite to prove the code works.

If pull requests do not comply with the above, they will likely be closed. Since we are a team of volunteers, we don't have any more time to work
on the framework than you do. Please make it as painless for your contributions to be included as possible.

See https://github.com/codeigniter4/CodeIgniter4/blob/develop/contributing/pull_request.md

Sincerely, the mergeable bot 🤖

Copy link
Copy Markdown
Member

@paulbalandan paulbalandan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A couple of tests and a changelog entry here are needed.

@paulbalandan paulbalandan added bug Verified issues on the current code behavior or pull requests that will fix them tests needed Pull requests that need tests docs needed Pull requests needing documentation write-ups and/or revisions. labels May 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Verified issues on the current code behavior or pull requests that will fix them docs needed Pull requests needing documentation write-ups and/or revisions. tests needed Pull requests that need tests

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Bug: [Memcached] session_start(): Unable to clear session lock record

2 participants