{"record":{"id":"923d02ca9f446c70","repo":"symfony/http-foundation","slug":"unable-to-create-a-session-id-migratingsessionhandler","errorCode":null,"errorMessage":"Unable to create a session ID.","messagePattern":"Unable to create a session ID\\.","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"Session/Storage/Handler/MigratingSessionHandler.php","lineNumber":43,"sourceCode":"    private \\SessionHandlerInterface&\\SessionUpdateTimestampHandlerInterface $currentHandler;\n    private \\SessionHandlerInterface&\\SessionUpdateTimestampHandlerInterface $writeOnlyHandler;\n\n    public function __construct(\\SessionHandlerInterface $currentHandler, \\SessionHandlerInterface $writeOnlyHandler)\n    {\n        if (!$currentHandler instanceof \\SessionUpdateTimestampHandlerInterface) {\n            $currentHandler = new StrictSessionHandler($currentHandler);\n        }\n        if (!$writeOnlyHandler instanceof \\SessionUpdateTimestampHandlerInterface) {\n            $writeOnlyHandler = new StrictSessionHandler($writeOnlyHandler);\n        }\n\n        $this->currentHandler = $currentHandler;\n        $this->writeOnlyHandler = $writeOnlyHandler;\n    }\n\n    public function create_sid(): string\n    {\n        return session_create_id() ?: throw new \\RuntimeException('Unable to create a session ID.');\n    }\n\n    public function close(): bool\n    {\n        $result = $this->currentHandler->close();\n        $this->writeOnlyHandler->close();\n\n        return $result;\n    }\n\n    public function destroy(#[\\SensitiveParameter] string $sessionId): bool\n    {\n        $result = $this->currentHandler->destroy($sessionId);\n        $this->writeOnlyHandler->destroy($sessionId);\n\n        return $result;\n    }\n","sourceCodeStart":25,"sourceCodeEnd":61,"githubUrl":"https://github.com/symfony/http-foundation/blob/5aea19cd678fa4140f6108406f1096de5e9ed6e4/Session/Storage/Handler/MigratingSessionHandler.php#L25-L61","documentation":"MigratingSessionHandler::create_sid() generates a session ID via session_create_id(), which returns '' (falsy) on failure; that is turned into RuntimeException('Unable to create a session ID.'). It means PHP could not generate a new session identifier in the current runtime context.","triggerScenarios":"session_create_id() failing — called without an initialized session environment, sessions disabled (e.g. CLI without session config), or PHP misconfiguration of the session save handler when the migrating handler asks for a fresh ID during session regeneration/migration.","commonSituations":"Long-running daemons/CLI workers using session handlers without proper session runtime setup; misconfigured session.save_path/save_handler in php.ini; calling create_sid() manually outside the normal session start/regenerate lifecycle.","solutions":["Initialize the session runtime (appropriate php.ini session settings, writable save_path, valid save_handler) before ID generation","Verify sessions are enabled in the SAPI being used (CLI/web) and session functions are not restricted (disable_functions)","Only call create_sid() as part of the normal session start/regenerate flow rather than manually","Generate the ID yourself with a CSPRNG fallback in a wrapper: bin2hex(random_bytes(16))"],"exampleFix":"// before\n$migratingHandler->create_sid(); // RuntimeException when session runtime not ready\n// after\nif (PHP_SESSION_NONE === session_status()) {\n    ini_set('session.use_strict_mode', '1');\n    session_start();\n}\n$id = $migratingHandler->create_sid();","handlingStrategy":"try-catch","validationCode":"if (PHP_SESSION_DISABLED === session_status()) {\n    throw new RuntimeException('Sessions disabled in this environment; cannot migrate session IDs.');\n}","typeGuard":"function sessionIdCreationAvailable(): bool\n{\n    return PHP_SESSION_DISABLED !== session_status() && function_exists('session_create_id');\n}","tryCatchPattern":"try {\n    $id = $migratingHandler->create_sid();\n} catch (\\RuntimeException $e) {\n    if ($e->getMessage() === 'Unable to create a session ID.') {\n        $id = bin2hex(random_bytes(16)); // CSPRNG fallback\n    } else {\n        throw $e;\n    }\n}","preventionTips":["Initialize session runtime (correct php.ini, writable save_path) before using migrating handlers","Avoid manual create_sid() calls outside session start/regeneration flows","Verify session functions are not disabled via disable_functions in your SAPI","Smoke-test session migration in CLI/worker contexts, not just web requests"],"tags":["session","session-id","migration","php"],"backgroundTag":"resource-not-found","analyzedSha":"5aea19cd678fa4140f6108406f1096de5e9ed6e4","analyzedAt":"2026-09-13T01:52:22.855Z","contentChangedAt":"2026-09-13T01:52:22.855Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}