phalcon/cphalcon · error · Phalcon\Session\Exceptions\InvalidSessionName

The name contains non alphanum characters

Error message

The name contains non alphanum characters

What it means

Manager::setName() accepts only names matching /^[\p{L}\p{N}_-]+$/u (unicode letters, digits, underscore, hyphen) and rejects names that are purely numeric; anything else (dots, spaces, symbols, empty string, '123') throws InvalidSessionName.

Source

Thrown at phalcon/Session/Manager.zep:307

     * and do not allow poop names
     *
     * @param string $name
     *
     * @return ManagerInterface
     * @throws InvalidSessionName
     * @throws SessionModificationDenied
     */
    public function setName(string name) -> <ManagerInterface>
    {
        if unlikely true === this->exists() {
            throw new SessionModificationDenied();
        }

        if unlikely (
            !preg_match("/^[\p{L}\p{N}_-]+$/u", name) ||
            preg_match("/^[0-9]+$/", name)
        ) {
            throw new InvalidSessionName();
        }

        let this->name = name;

        session_name(name);

        return this;
    }

    /**
     * Sets session's options
     *
     * @phpstan-param session_options $options
     */
    public function setOptions(array options) -> void
    {
        let this->uniqueId = this->getArrVal(options, "uniqueId", ""),
            this->options  = options;

View on GitHub (pinned to b7419de9cd)

Solutions

1. Use only letters, digits, underscore and hyphen, e.g. 'APPSESSID' or 'myapp_session'
2. Sanitize config-driven names: $name = preg_replace('/[^\p{L}\p{N}_-]/u', '', $name); then ensure it is non-empty and not all digits
3. Default the name in config so an unset value never reaches setName()

Example fix

// before
$session->setName('myapp.example.com'); // dot -> InvalidSessionName

// after
$session->setName('myapp_session');

function sanitizeSessionName(string $name): string
{
    $name = preg_replace('/[^\p{L}\p{N}_-]/u', '', $name);
    if ($name === '' || preg_match('/^[0-9]+$/', $name)) {
        $name = 'APPSESSID';
    }
    return $name;
}
$session->setName(sanitizeSessionName($config->get('session.name')));

function isValidPhalconSessionName(string $name): bool
{
    return (bool) preg_match('/^\p{L}[\p{L}\p{N}_-]*$/u', $name)
        && !preg_match('/^[0-9]+$/', $name);
}

When it happens

Trigger: Names like 'MY.SESSION' (dot), 'session id' (space), 'APP-SESSID!' (symbol), '' (empty), or '123' (all digits); names assembled from environment or host strings containing dots, e.g. 'app.example.com'.

Common situations: Using the domain as the cookie-name prefix; numeric names generated from a tenant/shop id; forgetting to set a name so an empty default string from config reaches setName(); names copied from other frameworks that allow dots.

Related errors

• The session id contains invalid characters
• Cannot set session name after a session has started
• Unable to insert into {table} without data
• The number of values in the update is not the same as fields
• The cookie's key should be at least 32 characters long. Curr

AI-assisted analysis of phalcon/cphalcon@b7419de9cd (2026-08-21). Data as JSON: /api/errors/34d29d7e44ecc9d6. Report an issue: GitHub.