{"record":{"id":"f7c768a6f2817dba","repo":"symfony/http-foundation","slug":"unable-to-create-a-session-id","errorCode":null,"errorMessage":"Unable to create a session ID.","messagePattern":"Unable to create a session ID\\.","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"Session/Storage/Handler/MarshallingSessionHandler.php","lineNumber":39,"sourceCode":"    public function __construct(\n        private AbstractSessionHandler $handler,\n        private MarshallerInterface $marshaller,\n    ) {\n    }\n\n    public function open(string $savePath, string $name): bool\n    {\n        return $this->handler->open($savePath, $name);\n    }\n\n    public function close(): bool\n    {\n        return $this->handler->close();\n    }\n\n    public function create_sid(): string\n    {\n        return session_create_id() ?: throw new \\RuntimeException('Unable to create a session ID.');\n    }\n\n    public function destroy(#[\\SensitiveParameter] string $sessionId): bool\n    {\n        return $this->handler->destroy($sessionId);\n    }\n\n    public function gc(int $maxlifetime): int|false\n    {\n        return $this->handler->gc($maxlifetime);\n    }\n\n    public function read(#[\\SensitiveParameter] string $sessionId): string\n    {\n        $data = $this->handler->read($sessionId);\n\n        try {\n            return $this->marshaller->unmarshall($data);","sourceCodeStart":21,"sourceCodeEnd":57,"githubUrl":"https://github.com/symfony/http-foundation/blob/5aea19cd678fa4140f6108406f1096de5e9ed6e4/Session/Storage/Handler/MarshallingSessionHandler.php#L21-L57","documentation":"MarshallingSessionHandler::create_sid() generates a session ID via session_create_id(), which returns an empty string (falsy) on failure. When that happens it throws RuntimeException('Unable to create a session ID.'). It signals that PHP's session ID generator could not produce an ID (usually no active session environment or a misconfigured save handler).","triggerScenarios":"session_create_id() returning '' — typically called outside an active session context, when session.use_strict_mode/save-handler configuration is broken, or when session_start/session state is invalid at the time the handler's create_sid() is invoked.","commonSituations":"Using MarshallingSessionHandler as a standalone SessionHandlerInterface without PHP session runtime initialized; calling create_sid() during a request where sessions are disabled (session.use_sessions off or CLI without session setup); PHP misconfiguration of session.save_handler.","solutions":["Ensure the PHP session runtime is properly initialized before session id creation (session settings loaded, save handler registered)","Verify php.ini session.* settings (save_path writable, save_handler valid) and that sessions are not disabled","Avoid calling create_sid() outside of an active session lifecycle; let PHP request IDs via its session start flow","Fall back to generating your own ID (e.g. bin2hex(random_bytes(16))) in a custom handler"],"exampleFix":"// before\n$id = $handler->create_sid(); // RuntimeException outside session context\n// after\nif (PHP_SESSION_NONE === session_status()) {\n    session_start();\n}\n$id = $handler->create_sid();","handlingStrategy":"try-catch","validationCode":"if (PHP_SESSION_DISABLED === session_status()) {\n    throw new RuntimeException('Sessions are disabled; cannot create a session ID.');\n}","typeGuard":"function canCreateSessionId(): bool\n{\n    return PHP_SESSION_DISABLED !== session_status() && function_exists('session_create_id');\n}","tryCatchPattern":"try {\n    $id = $handler->create_sid();\n} catch (\\RuntimeException $e) {\n    if ($e->getMessage() === 'Unable to create a session ID.') {\n        $id = bin2hex(random_bytes(16)); // CSPRNG fallback\n    } else {\n        throw $e;\n    }\n}","preventionTips":["Ensure session runtime is initialized (session_start / correct php.ini) before handler use","Check writable session save_path and valid save_handler configuration","Do not call create_sid() manually outside the session lifecycle","Test session setup in the exact SAPI/environment (CLI vs web) you deploy to"],"tags":["session","session-id","php"],"backgroundTag":"resource-not-found","analyzedSha":"5aea19cd678fa4140f6108406f1096de5e9ed6e4","analyzedAt":"2026-09-13T01:52:22.855Z","contentChangedAt":"2026-09-13T01:52:22.855Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}