{"record":{"id":"0f0e12522a52c3d1","repo":"phalcon/cphalcon","slug":"the-session-has-already-been-started-to-change-th","errorCode":null,"errorMessage":"The session has already been started. To change the id, use regenerateId()","messagePattern":"The session has already been started\\. To change the id, use regenerateId\\(\\)","errorType":"exception","errorClass":"Phalcon\\Session\\Exceptions\\SessionAlreadyStarted","httpStatus":null,"severity":"error","filePath":"phalcon/Session/Manager.zep","lineNumber":275,"sourceCode":"     */\n    public function setAdapter(<SessionHandlerInterface> adapter) -> <ManagerInterface>\n    {\n        let this->adapter = adapter;\n\n        return this;\n    }\n\n    /**\n     * Set session Id\n     *\n     * @return ManagerInterface\n     * @throws InvalidSessionId\n     * @throws SessionAlreadyStarted\n     */\n    public function setId(string sessionId) -> <ManagerInterface>\n    {\n        if unlikely (true === this->exists()) {\n            throw new SessionAlreadyStarted();\n        }\n\n        if unlikely !preg_match(\"/^[a-zA-Z0-9,-]+$/D\", sessionId) {\n            throw new InvalidSessionId();\n        }\n\n        session_id(sessionId);\n\n        return this;\n    }\n\n    /**\n     * Set the session name. Throw exception if the session has started\n     * and do not allow poop names\n     *\n     * @param string $name\n     *\n     * @return ManagerInterface","sourceCodeStart":257,"sourceCodeEnd":293,"githubUrl":"https://github.com/phalcon/cphalcon/blob/b7419de9cd0a8a3f48441ead84c9f8415d463e25/phalcon/Session/Manager.zep#L257-L293","documentation":"Manager::setId() assigns a new session id before the session starts; once a session is active (Manager::exists() true, session_status active) the id is already in use, so Phalcon throws SessionAlreadyStarted and points you to regenerateId().","triggerScenarios":"Calling $session->setId($id) after $session->start(); PHP auto-starting sessions via session.auto_start=1 so any later setId throws; middleware that pins a custom id running after the session middleware already started the session.","commonSituations":"Enabling session.auto_start in php.ini or the FPM pool; porting plain-PHP code that called session_id() after session_start(); two components (auth listener and bootstrap) both configuring the session, one too late.","solutions":["Call setId() before start(), immediately after creating the Manager and setting the adapter","To rotate the id of a live session (session fixation defense) use $session->regenerateId(true)","Disable session.auto_start so the Manager owns session startup","Guard the call: if (!$session->exists()) { $session->setId($id); }"],"exampleFix":"// before\n$session->start();\n$session->setId($newId); // SessionAlreadyStarted\n\n// after\nif (!$session->exists()) {\n    $session->setId($newId);\n}\n$session->start();\n// rotating an already-active session id:\n$session->regenerateId(true);","handlingStrategy":"validation","validationCode":"if (!$session->exists()) {\n    $session->setId($newId);\n}\n// rotating an active session:\nif ($session->exists()) {\n    $session->regenerateId(true);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep all session-identity calls (setName, setId) before start() in one bootstrap place","Disable session.auto_start so ordering is under your control","Use regenerateId() for id rotation after login; reserve setId() for pre-start pinning"],"tags":["php","phalcon","session","session-id","lifecycle"],"backgroundTag":"session-already-started","analyzedSha":"b7419de9cd0a8a3f48441ead84c9f8415d463e25","analyzedAt":"2026-08-21T06:21:18.811Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}