{"record":{"id":"d77fedf15f12286c","repo":"symfony/http-foundation","slug":"s-accepts-only-string-as-data","errorCode":null,"errorMessage":"%s accepts only string as data.","messagePattern":"(.+?) accepts only string as data\\.","errorType":"exception","errorClass":"LogicException","httpStatus":null,"severity":"error","filePath":"Session/Storage/Handler/IdentityMarshaller.php","lineNumber":25,"sourceCode":" *\n * For the full copyright and license information, please view the LICENSE\n * file that was distributed with this source code.\n */\n\nnamespace Symfony\\Component\\HttpFoundation\\Session\\Storage\\Handler;\n\nuse Symfony\\Component\\Cache\\Marshaller\\MarshallerInterface;\n\n/**\n * @author Ahmed TAILOULOUTE <ahmed.tailouloute@gmail.com>\n */\nclass IdentityMarshaller implements MarshallerInterface\n{\n    public function marshall(array $values, ?array &$failed): array\n    {\n        foreach ($values as $key => $value) {\n            if (!\\is_string($value)) {\n                throw new \\LogicException(\\sprintf('%s accepts only string as data.', __METHOD__));\n            }\n        }\n\n        return $values;\n    }\n\n    public function unmarshall(string $value): string\n    {\n        return $value;\n    }\n}\n","sourceCodeStart":7,"sourceCodeEnd":37,"githubUrl":"https://github.com/symfony/http-foundation/blob/5aea19cd678fa4140f6108406f1096de5e9ed6e4/Session/Storage/Handler/IdentityMarshaller.php#L7-L37","documentation":"IdentityMarshaller::marshall() is an identity marshaller: it passes values through unchanged, but only accepts strings (its contract is to serialize strings). It throws LogicException if any value in the $values map is not a string, because such values would be silently mis-stored by the session handler it fronts.","triggerScenarios":"Calling marshall() with an array containing any non-string value (int, float, array, object, null). In practice, storing non-scalar session data (e.g. $_SESSION['x'] = new \\DateTime()) through a marshalling session handler configured with IdentityMarshaller.","commonSituations":"Developers putting objects or arrays into session storage while using MarshallingSessionHandler with IdentityMarshaller; forgetting to use a real serializer marshaller (e.g. DefaultMarshaller) for non-string session values.","solutions":["Ensure every value written to the session is a string before storage","Replace IdentityMarshaller with a serializing marshaller such as DefaultMarshaller (supports any serializable value)","Cast/serialize objects yourself (serialize(), json_encode()) before assigning to the session","Add a type check in your session-writing code path to catch non-string values early"],"exampleFix":"// before\n$marshaller = new IdentityMarshaller();\n$_SESSION['cart'] = $cartObject; // LogicException at write time\n// after\n$marshaller = new \\Symfony\\Component\\HttpFoundation\\Session\\Storage\\Handler\\MarshallingSessionHandler($handler, new \\Symfony\\Component\\HttpFoundation\\Session\\Storage\\Handler\\DefaultMarshaller());\n// or store a string\n$_SESSION['cart'] = serialize($cartObject);","handlingStrategy":"validation","validationCode":"foreach ($_SESSION as $k => $v) {\n    if (!is_string($v)) {\n        throw new InvalidArgumentException(sprintf('Session key \"%s\" must be a string when using IdentityMarshaller, got %s.', $k, get_debug_type($v)));\n    }\n}","typeGuard":"function allSessionValuesAreStrings(array $values): bool\n{\n    return array_reduce($values, fn (bool $ok, $v) => $ok && is_string($v), true);\n}","tryCatchPattern":null,"preventionTips":["Only store strings (already-serialized data) in the session when using IdentityMarshaller","Use DefaultMarshaller when you need to store objects/arrays","Unit-test session writes with representative payloads to catch non-string values early"],"tags":["session","type-mismatch","php"],"backgroundTag":"type-mismatch","analyzedSha":"5aea19cd678fa4140f6108406f1096de5e9ed6e4","analyzedAt":"2026-09-13T01:52:22.855Z","contentChangedAt":"2026-09-13T01:52:22.855Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}