symfony/http-foundation · error · SessionNotFoundException

Session has not been set.

Error message

Session has not been set.

What it means

Request::getSession() returns the session attached to the request. If no session (and no session factory) has been attached via setSession() or a session listener, it throws SessionNotFoundException('Session has not been set.'). HttpFoundation intentionally does not auto-create sessions; the framework's session listener does that.

Solutions

1. Attach a session first: $request->setSession(new Session(new MockArraySessionStorage())) (or the native storage).
2. In Symfony apps, ensure framework.session is enabled and routes go through the kernel so SessionListener sets the session.
3. Call $request->hasSession() or hasPreviousSession() before calling getSession().
4. In tests, use StaticRequestFactory or KernelTestCase which wires the session automatically.

Example fix

// before
$session = $request->getSession(); // throws

// after
if ($request->hasSession()) {
    $session = $request->getSession();
}

if ($request->hasPreviousSession() || $request->hasSession()) { /* safe to call getSession */ }

function getOptionalSession(Request $request): ?SessionInterface
{
    return $request->hasSession() ? $request->getSession() : null;
}

use Symfony\Component\HttpFoundation\Exception\SessionNotFoundException;

try {
    $session = $request->getSession();
} catch (SessionNotFoundException $e) {
    $session = null; // or start a session with setSession()
}

When it happens

Trigger: Calling $request->getSession() on a request created manually (e.g. Request::create() in tests) without calling setSession() first, or on requests handled outside the framework's SessionListener lifecycle; also via hasPreviousSession() indirect access.

Common situations: Functional tests that build Request::create('/')->getSession(); controllers hit by requests where sessions are disabled or the session storage service isn't configured; CLI commands/queue workers that simulate requests without the session service.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• Invalid URI: Path is malformed.
• Invalid URI: Scheme is malformed.
• Invalid URI.
• Invalid URI: Userinfo is malformed.
• Invalid URI: Host is malformed.

AI-assisted analysis of symfony/http-foundation@5aea19cd67 (2026-09-13). Data as JSON: /api/errors/c12dfd771fc0bb73. Report an issue: GitHub.

Appendix: source

Thrown at Request.php:807

    public static function getAllowedHttpMethodOverride(): ?array
    {
        return self::$allowedHttpMethodOverride;
    }

    /**
     * Gets the Session.
     *
     * @throws SessionNotFoundException When session is not set properly
     */
    public function getSession(): SessionInterface
    {
        $session = $this->session;
        if (!$session instanceof SessionInterface && null !== $session) {
            $this->setSession($session = $session());
        }

        if (null === $session) {
            throw new SessionNotFoundException('Session has not been set.');
        }

        return $session;
    }

    /**
     * Whether the request contains a Session which was started in one of the
     * previous requests.
     */
    public function hasPreviousSession(): bool
    {
        // the check for $this->session avoids malicious users trying to fake a session cookie with proper name
        return $this->hasSession() && $this->cookies->has($this->getSession()->getName());
    }

    /**
     * Whether the request contains a Session object.
     *

View on GitHub (pinned to 5aea19cd67)