{"record":{"id":"dcea0c7f609bf374","repo":"phalcon/cphalcon","slug":"cannot-set-session-name-after-a-session-has-starte","errorCode":null,"errorMessage":"Cannot set session name after a session has started","messagePattern":"Cannot set session name after a session has started","errorType":"exception","errorClass":"Phalcon\\Session\\Exceptions\\SessionModificationDenied","httpStatus":null,"severity":"error","filePath":"phalcon/Session/Manager.zep","lineNumber":300,"sourceCode":"        session_id(sessionId);\n\n        return this;\n    }\n\n    /**\n     * Set the session name. Throw exception if the session has started\n     * and do not allow poop names\n     *\n     * @param string $name\n     *\n     * @return ManagerInterface\n     * @throws InvalidSessionName\n     * @throws SessionModificationDenied\n     */\n    public function setName(string name) -> <ManagerInterface>\n    {\n        if unlikely true === this->exists() {\n            throw new SessionModificationDenied();\n        }\n\n        if unlikely (\n            !preg_match(\"/^[\\p{L}\\p{N}_-]+$/u\", name) ||\n            preg_match(\"/^[0-9]+$/\", name)\n        ) {\n            throw new InvalidSessionName();\n        }\n\n        let this->name = name;\n\n        session_name(name);\n\n        return this;\n    }\n\n    /**\n     * Sets session's options","sourceCodeStart":282,"sourceCodeEnd":318,"githubUrl":"https://github.com/phalcon/cphalcon/blob/b7419de9cd0a8a3f48441ead84c9f8415d463e25/phalcon/Session/Manager.zep#L282-L318","documentation":"Manager::setName() sets the session/cookie name and may only run before the session becomes active, because the old cookie name is already committed. Once Manager::exists() is true Phalcon throws SessionModificationDenied.","triggerScenarios":"Calling setName() after start(); session.auto_start=1 making the session active before any code runs; setting the name from a controller or route handler that executes after the session bootstrap already started it.","commonSituations":"Reordering middleware so the session starts before the naming step; porting apps that called session_name() late; shared hosting with auto_start forced on; multi-site codebases selecting a per-tenant cookie name after login.","solutions":["Set the name immediately after instantiating the Manager, before start()","Disable session.auto_start in php.ini/FPM pool so startup ordering is explicit","Guard the call: if (!$session->exists()) { $session->setName($name); }","For per-tenant cookie names, decide the name before any request starts the session (e.g. from the host in a bootstrap event)"],"exampleFix":"// before\n$session->start();\n$session->setName('APPSESSID'); // SessionModificationDenied\n\n// after\n$session->setName('APPSESSID');\n$session->start();","handlingStrategy":"validation","validationCode":"if (!$session->exists()) {\n    $session->setName($name);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Set name and id in the same pre-start bootstrap block","Turn off session.auto_start in every pool/ini so late setName cannot happen","Decide per-tenant cookie names from the request host before the session middleware runs"],"tags":["php","phalcon","session","cookies","lifecycle"],"backgroundTag":"session-already-started","analyzedSha":"b7419de9cd0a8a3f48441ead84c9f8415d463e25","analyzedAt":"2026-08-21T06:21:18.811Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}