phalcon/cphalcon · error · Phalcon\Session\Exceptions\InvalidSessionId

The session id contains invalid characters

Error message

The session id contains invalid characters

What it means

Manager::setId() validates the id against /^[a-zA-Z0-9,-]+$/D, the PHP session id alphabet (letters, digits, comma, hyphen). InvalidSessionId is thrown for anything outside that set, including an empty string, +, /, =, _, dots and whitespace.

Source

Thrown at phalcon/Session/Manager.zep:279

        return this;
    }

    /**
     * Set session Id
     *
     * @return ManagerInterface
     * @throws InvalidSessionId
     * @throws SessionAlreadyStarted
     */
    public function setId(string sessionId) -> <ManagerInterface>
    {
        if unlikely (true === this->exists()) {
            throw new SessionAlreadyStarted();
        }

        if unlikely !preg_match("/^[a-zA-Z0-9,-]+$/D", sessionId) {
            throw new InvalidSessionId();
        }

        session_id(sessionId);

        return this;
    }

    /**
     * Set the session name. Throw exception if the session has started
     * and do not allow poop names
     *
     * @param string $name
     *
     * @return ManagerInterface
     * @throws InvalidSessionName
     * @throws SessionModificationDenied
     */
    public function setName(string name) -> <ManagerInterface>

View on GitHub (pinned to b7419de9cd)

Solutions

1. Generate ids with bin2hex(random_bytes(16)) or session_create_id() — hex is always valid
2. Sanitize external ids: $id = preg_replace('/[^a-zA-Z0-9,-]/', '', $id); and fall back to a fresh id when the result is empty
3. For cross-application ids agree on the [a-zA-Z0-9,-] alphabet in the contract

Example fix

// before
$session->setId(base64_encode(random_bytes(16))); // contains +/= -> InvalidSessionId

// after
$session->setId(bin2hex(random_bytes(16)));

function assertValidSessionId(string $id): string
{
    if (!preg_match('/^[a-zA-Z0-9,-]+$/D', $id)) {
        throw new InvalidArgumentException('Session id violates [a-zA-Z0-9,-] alphabet');
    }
    return $id;
}
$session->setId(assertValidSessionId($incomingId));

function isValidPhalconSessionId(string $id): bool
{
    return (bool) preg_match('/^[a-zA-Z0-9,-]+$/D', $id);
}

When it happens

Trigger: Passing a base64 id (contains +/=), a base64url id (contains _), uniqid('', true) output (contains a dot), an empty string, or an id round-tripped from a cookie/query param of another app with a different alphabet; hex ids from bin2hex(random_bytes()) always pass.

Common situations: Hand-rolled id generation with base64_encode(random_bytes(...)) instead of bin2hex; SSO/multi-app setups where the sibling app issues ids with underscores; ids forwarded from URLs and passed to setId() unvalidated.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• The session has already been started. To change the id, use
• The name contains non alphanum characters
• Unable to insert into {table} without data
• The number of values in the update is not the same as fields
• Invalid host {host}

AI-assisted analysis of phalcon/cphalcon@b7419de9cd (2026-08-21). Data as JSON: /api/errors/5e9229d9eee4a113. Report an issue: GitHub.