symfony/http-foundation · error · RuntimeException

Unable to create a session ID.

Error message

Unable to create a session ID.

What it means

MarshallingSessionHandler::create_sid() generates a session ID via session_create_id(), which returns an empty string (falsy) on failure. When that happens it throws RuntimeException('Unable to create a session ID.'). It signals that PHP's session ID generator could not produce an ID (usually no active session environment or a misconfigured save handler).

Solutions

1. Ensure the PHP session runtime is properly initialized before session id creation (session settings loaded, save handler registered)
2. Verify php.ini session.* settings (save_path writable, save_handler valid) and that sessions are not disabled
3. Avoid calling create_sid() outside of an active session lifecycle; let PHP request IDs via its session start flow
4. Fall back to generating your own ID (e.g. bin2hex(random_bytes(16))) in a custom handler

Example fix

// before
$id = $handler->create_sid(); // RuntimeException outside session context
// after
if (PHP_SESSION_NONE === session_status()) {
    session_start();
}
$id = $handler->create_sid();

if (PHP_SESSION_DISABLED === session_status()) {
    throw new RuntimeException('Sessions are disabled; cannot create a session ID.');
}

function canCreateSessionId(): bool
{
    return PHP_SESSION_DISABLED !== session_status() && function_exists('session_create_id');
}

try {
    $id = $handler->create_sid();
} catch (\RuntimeException $e) {
    if ($e->getMessage() === 'Unable to create a session ID.') {
        $id = bin2hex(random_bytes(16)); // CSPRNG fallback
    } else {
        throw $e;
    }
}

When it happens

Trigger: session_create_id() returning '' — typically called outside an active session context, when session.use_strict_mode/save-handler configuration is broken, or when session_start/session state is invalid at the time the handler's create_sid() is invoked.

Common situations: Using MarshallingSessionHandler as a standalone SessionHandlerInterface without PHP session runtime initialized; calling create_sid() during a request where sessions are disabled (session.use_sessions off or CLI without session setup); PHP misconfiguration of session.save_handler.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• Unable to create a session ID.
• accepts only string as data.
• The session handler " " does not support clearing all…
• Session has not been set.
• The "sameSite" parameter value is not valid.

AI-assisted analysis of symfony/http-foundation@5aea19cd67 (2026-09-13). Data as JSON: /api/errors/f7c768a6f2817dba. Report an issue: GitHub.

Appendix: source

Thrown at Session/Storage/Handler/MarshallingSessionHandler.php:39

    public function __construct(
        private AbstractSessionHandler $handler,
        private MarshallerInterface $marshaller,
    ) {
    }

    public function open(string $savePath, string $name): bool
    {
        return $this->handler->open($savePath, $name);
    }

    public function close(): bool
    {
        return $this->handler->close();
    }

    public function create_sid(): string
    {
        return session_create_id() ?: throw new \RuntimeException('Unable to create a session ID.');
    }

    public function destroy(#[\SensitiveParameter] string $sessionId): bool
    {
        return $this->handler->destroy($sessionId);
    }

    public function gc(int $maxlifetime): int|false
    {
        return $this->handler->gc($maxlifetime);
    }

    public function read(#[\SensitiveParameter] string $sessionId): string
    {
        $data = $this->handler->read($sessionId);

        try {
            return $this->marshaller->unmarshall($data);

View on GitHub (pinned to 5aea19cd67)