Skip to content

Fix/8.6.0 session failures - #2900

Merged
michael-grunder merged 2 commits into
developfrom
fix/8.6.0-session-failures
Jul 26, 2026
Merged

Fix/8.6.0 session failures#2900
michael-grunder merged 2 commits into
developfrom
fix/8.6.0-session-failures

Conversation

@michael-grunder

@michael-grunder michael-grunder commented Jul 25, 2026

Copy link
Copy Markdown
Member

Fix session handler logic for PHP 8.6

Fixes #2898

PHP 8.6 is making session strict mode the default. This slightly changes
the semantics around session ids.

This fix mostly just allows us to disable strict mode for our tests
which need to use their own ids to confirm locking functionality.

Also we add some logic to the session handlers to keep track of if we
need to generate an ID which should allow us to preserve lazy write
semantics.

Fixes #2898
@michael-grunder
michael-grunder force-pushed the fix/8.6.0-session-failures branch from f401cc1 to 5366285 Compare July 25, 2026 22:27

@remicollet remicollet left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All tests passed. \o/

(tested with 8.4.23 and 8.6.0alpha2)

@michael-grunder
michael-grunder merged commit f5460cc into develop Jul 26, 2026
86 checks passed
@michael-grunder
michael-grunder deleted the fix/8.6.0-session-failures branch July 26, 2026 05:10
@remicollet

Copy link
Copy Markdown
Collaborator

@michael-grunder is this fix related to session.use_strict_mode = 1 new default value in 8.6 ?

In this case, does this affect old PHP versions when the configuration is changed ?

In php.ini for 8.5

It is disabled by default for maximum compatibility, but enabling it is encouraged

@remicollet

Copy link
Copy Markdown
Collaborator

I confirm the problem

Running PHP 8.4.23 with phpredis 6.3.0 with -d session.use_strict_mode=1 -d session.cookie_httponly=1 -d session.cookie_samesite=Lax raise the same failure

@michael-grunder

Copy link
Copy Markdown
Member Author

I didn't dig deeply into it but yes, I assume these test failures occur with strict mode enabled.

That said most of the test failures have to do with the helper script attempting to inject a specific session id to look for the lock key, etc. in normal operation people just call session_start and let PHP pick the id

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

PHP 8.6.0alpha2 - Test suite fails

2 participants