Fix session in long-running apps

[viktorprogger]

Q	A
Is bugfix?	✔️
New feature?	❌
Breaks BC?	❌
Fixed issues	❌

Fixes a bug for long-running applications: session is not resetted between requests. Session ids are UTF-safe, as this may be critical for some session handlers.

[vjik]

What about collision check? session_create_id don't check collision if called before start session.

[viktorprogger]

Any idea?

[vjik]

I don't know. In symfony it's not check. May be to make custom session ID creating optional? Use boolean flag or callback or create SessionIdGeneratorInterface?

[viktorprogger]

I think this would be very non-intuitive for users

[vjik]

I think this would be very non-intuitive for users

Then we must find solutions without collision risk. Otherwise we fix bug for longliving apps, but add new problem with collisions.

[Tigrov]

What about this?

session_start($this->options);
$this->sessionId = session_create_id();
session_write_close();
session_id($this->sessionId);

[vjik]

What about this?

session_start($this->options);
$this->sessionId = session_create_id();
session_write_close();
session_id($this->sessionId);

This will entail additional costs on read/write session data.

[samdark]

Extra opening a session doesn't sound good to me.

[samdark]

There's also https://www.php.net/manual/en/session.configuration.php#ini.session.use-strict-mode. We should take that into account.