phalcon/cphalcon · error · Phalcon\Auth\Exceptions\SessionNamesMustDiffer

Session guard 'name' and 'rememberName' must differ

Error message

Session guard 'name' and 'rememberName' must differ

What it means

SessionGuardConfig configures the session guard, which stores the authenticated user under one session key (name) and the remember-me token under another (rememberName). If both resolve to the same string, one would overwrite the other in the session store, so the constructor rejects the combination with SessionNamesMustDiffer. Default derivation ('auth'+suffix vs 'remember'+suffix) can never collide; the error only occurs when explicitly supplied values are equal.

Source

Thrown at phalcon/Auth/Guard/Config/SessionGuardConfig.zep:58

    /**
     * @throws Exception
     */
    public function __construct(
        string suffix = null,
        string name = null,
        string rememberName = null,
        int rememberTtl = null
    ) {
        this->validateNonEmpty("suffix", suffix);
        this->validateNonEmpty("name", name);
        this->validateNonEmpty("rememberName", rememberName);

        let this->name         = null !== name ? name : this->derive("auth", suffix);
        let this->rememberName = null !== rememberName ? rememberName : this->derive("remember", suffix);
        let this->rememberTtl  = null !== rememberTtl ? rememberTtl : self::DEFAULT_REMEMBER_TTL;

        if (this->name === this->rememberName) {
            throw new SessionNamesMustDiffer();
        }
    }

    public function getName() -> string
    {
        return this->name;
    }

    public function getRememberName() -> string
    {
        return this->rememberName;
    }

    public function getRememberTtl() -> int
    {
        return this->rememberTtl;
    }

View on GitHub (pinned to b7419de9cd)

Solutions

1. Give rememberName a distinct value, e.g. name: 'auth_web', rememberName: 'remember_web'
2. Or drop both keys and rely on the derived defaults, which are always distinct ('auth'+suffix and 'remember'+suffix)
3. Add a startup assertion in your config loader that the two values differ, so it fails fast with your own message

Example fix

// before
new SessionGuardConfig(suffix: 'web', name: 'auth', rememberName: 'auth');

// after
new SessionGuardConfig(suffix: 'web', name: 'auth', rememberName: 'remember');

if (isset($guardOptions['name'], $guardOptions['rememberName'])
    && $guardOptions['name'] === $guardOptions['rememberName']) {
    throw new InvalidArgumentException('session name and rememberName must differ');
}

When it happens

Trigger: Constructing SessionGuardConfig (directly or via guard options 'name' and 'rememberName') with both set to the same non-empty string, e.g. name: 'auth_session', rememberName: 'auth_session'.

Common situations: Copy-pasted auth config where both keys got the same value; an attempt to 'simplify' config by using one key for both concerns; templating/config generators that inject the same session key everywhere.

Related errors

• No default guard registered
• Auth guard '{name}' is not defined
• Unknown auth guard '{type}'
• Malformed ACL snapshot structure
• Stream adapter file does not exist: {path}

AI-assisted analysis of phalcon/cphalcon@b7419de9cd (2026-08-21). Data as JSON: /api/errors/bf409d92d585e4e6. Report an issue: GitHub.