phalcon/cphalcon · error · Phalcon\Session\Exceptions\SessionModificationDenied

Cannot set session name after a session has started

Error message

Cannot set session name after a session has started

What it means

Manager::setName() sets the session/cookie name and may only run before the session becomes active, because the old cookie name is already committed. Once Manager::exists() is true Phalcon throws SessionModificationDenied.

Source

Thrown at phalcon/Session/Manager.zep:300

        session_id(sessionId);

        return this;
    }

    /**
     * Set the session name. Throw exception if the session has started
     * and do not allow poop names
     *
     * @param string $name
     *
     * @return ManagerInterface
     * @throws InvalidSessionName
     * @throws SessionModificationDenied
     */
    public function setName(string name) -> <ManagerInterface>
    {
        if unlikely true === this->exists() {
            throw new SessionModificationDenied();
        }

        if unlikely (
            !preg_match("/^[\p{L}\p{N}_-]+$/u", name) ||
            preg_match("/^[0-9]+$/", name)
        ) {
            throw new InvalidSessionName();
        }

        let this->name = name;

        session_name(name);

        return this;
    }

    /**
     * Sets session's options

View on GitHub (pinned to b7419de9cd)

Solutions

1. Set the name immediately after instantiating the Manager, before start()
2. Disable session.auto_start in php.ini/FPM pool so startup ordering is explicit
3. Guard the call: if (!$session->exists()) { $session->setName($name); }
4. For per-tenant cookie names, decide the name before any request starts the session (e.g. from the host in a bootstrap event)

Example fix

// before
$session->start();
$session->setName('APPSESSID'); // SessionModificationDenied

// after
$session->setName('APPSESSID');
$session->start();

if (!$session->exists()) {
    $session->setName($name);
}

When it happens

Trigger: Calling setName() after start(); session.auto_start=1 making the session active before any code runs; setting the name from a controller or route handler that executes after the session bootstrap already started it.

Common situations: Reordering middleware so the session starts before the naming step; porting apps that called session_name() late; shared hosting with auto_start forced on; multi-site codebases selecting a per-tenant cookie name after login.

Related errors

• The session has already been started. To change the id, use
• The name contains non alphanum characters
• Nested transaction with savepoints behavior cannot be change
• The cookie's key should be at least 32 characters long. Curr
• A dependency injection container is required to access the '

AI-assisted analysis of phalcon/cphalcon@b7419de9cd (2026-08-21). Data as JSON: /api/errors/dcea0c7f609bf374. Report an issue: GitHub.