{"record":{"id":"bf409d92d585e4e6","repo":"phalcon/cphalcon","slug":"session-guard-name-and-remembername-must-diffe","errorCode":null,"errorMessage":"Session guard 'name' and 'rememberName' must differ","messagePattern":"Session guard 'name' and 'rememberName' must differ","errorType":"exception","errorClass":"Phalcon\\Auth\\Exceptions\\SessionNamesMustDiffer","httpStatus":null,"severity":"error","filePath":"phalcon/Auth/Guard/Config/SessionGuardConfig.zep","lineNumber":58,"sourceCode":"    /**\n     * @throws Exception\n     */\n    public function __construct(\n        string suffix = null,\n        string name = null,\n        string rememberName = null,\n        int rememberTtl = null\n    ) {\n        this->validateNonEmpty(\"suffix\", suffix);\n        this->validateNonEmpty(\"name\", name);\n        this->validateNonEmpty(\"rememberName\", rememberName);\n\n        let this->name         = null !== name ? name : this->derive(\"auth\", suffix);\n        let this->rememberName = null !== rememberName ? rememberName : this->derive(\"remember\", suffix);\n        let this->rememberTtl  = null !== rememberTtl ? rememberTtl : self::DEFAULT_REMEMBER_TTL;\n\n        if (this->name === this->rememberName) {\n            throw new SessionNamesMustDiffer();\n        }\n    }\n\n    public function getName() -> string\n    {\n        return this->name;\n    }\n\n    public function getRememberName() -> string\n    {\n        return this->rememberName;\n    }\n\n    public function getRememberTtl() -> int\n    {\n        return this->rememberTtl;\n    }\n","sourceCodeStart":40,"sourceCodeEnd":76,"githubUrl":"https://github.com/phalcon/cphalcon/blob/b7419de9cd0a8a3f48441ead84c9f8415d463e25/phalcon/Auth/Guard/Config/SessionGuardConfig.zep#L40-L76","documentation":"SessionGuardConfig configures the session guard, which stores the authenticated user under one session key (name) and the remember-me token under another (rememberName). If both resolve to the same string, one would overwrite the other in the session store, so the constructor rejects the combination with SessionNamesMustDiffer. Default derivation ('auth'+suffix vs 'remember'+suffix) can never collide; the error only occurs when explicitly supplied values are equal.","triggerScenarios":"Constructing SessionGuardConfig (directly or via guard options 'name' and 'rememberName') with both set to the same non-empty string, e.g. name: 'auth_session', rememberName: 'auth_session'.","commonSituations":"Copy-pasted auth config where both keys got the same value; an attempt to 'simplify' config by using one key for both concerns; templating/config generators that inject the same session key everywhere.","solutions":["Give rememberName a distinct value, e.g. name: 'auth_web', rememberName: 'remember_web'","Or drop both keys and rely on the derived defaults, which are always distinct ('auth'+suffix and 'remember'+suffix)","Add a startup assertion in your config loader that the two values differ, so it fails fast with your own message"],"exampleFix":"// before\nnew SessionGuardConfig(suffix: 'web', name: 'auth', rememberName: 'auth');\n\n// after\nnew SessionGuardConfig(suffix: 'web', name: 'auth', rememberName: 'remember');","handlingStrategy":"validation","validationCode":"if (isset($guardOptions['name'], $guardOptions['rememberName'])\n    && $guardOptions['name'] === $guardOptions['rememberName']) {\n    throw new InvalidArgumentException('session name and rememberName must differ');\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Prefer the derived defaults (omit name/rememberName) so the guard generates distinct keys","Add a config lint rule that rejects equal name/rememberName values","Keep session key names in one constants class to avoid drift"],"tags":["auth","session","guard","configuration"],"backgroundTag":"duplicate-configuration-value","analyzedSha":"b7419de9cd0a8a3f48441ead84c9f8415d463e25","analyzedAt":"2026-08-21T06:21:18.811Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}