walkor/workerman · error · RuntimeException

session_create_id() failed

Error message

session_create_id() failed

What it means

Request::createSessionId() wraps PHP's native session_create_id(). That function returns false (instead of throwing) when it cannot generate an id, which in practice happens when a native PHP session is already active in the process. Workerman then surfaces this as a RuntimeException.

Source

Thrown at src/Protocols/Http/Request.php:724

            return 0;
        }
        $filesEncodeStr .= urlencode($uploadKey) . '=' . count($files) . '&';
        $files[] = $file;

        return $sectionEndOffset + strlen($boundary) + 2;
    }

    /**
     * Create session id.
     *
     * @return string
     * @throws RuntimeException
     */
    public static function createSessionId(): string
    {
        $sid = session_create_id();
        if ($sid === false) {
            throw new RuntimeException('session_create_id() failed');
        }
        return $sid;
    }

    /**
     * @param string $sessionName
     * @param string $sid
     * @param array $cookieParams
     * @return void
     */
    protected function setSidCookie(string $sessionName, string $sid, array $cookieParams): void
    {
        if (!$this->connection) {
            throw new RuntimeException('Request->setSidCookie() fail, header already send');
        }
        $this->connection->headers['Set-Cookie'] = [$sessionName . '=' . $sid
            . (empty($cookieParams['domain']) ? '' : '; Domain=' . $cookieParams['domain'])
            . (empty($cookieParams['lifetime']) ? '' : '; Max-Age=' . $cookieParams['lifetime'])

View on GitHub (pinned to 1391112a61)

Solutions

  1. Search the codebase and vendor for session_start()/session_id() calls and remove them from code that runs inside Workerman workers
  2. Use only Workerman's own session API ($request->session(), Session classes), never the native session functions
  3. As a diagnostic, log session_status() in onWorkerStart to confirm PHP_SESSION_NONE

Example fix

// before (legacy FPM code inside a worker)
session_start();
$session = $request->session(); // later -> session_create_id() failed

// after
$session = $request->session(); // Workerman manages the id itself
Defensive patterns

Strategy: validation

Validate before calling

if (session_status() === PHP_SESSION_ACTIVE) {
    // legacy code started a native session inside the worker - find and remove it
    throw new LogicException('native session must not be started inside Workerman');
}

Try / catch

try { $sid = Request::createSessionId(); } catch (RuntimeException $e) { /* fallback id generation */ $sid = bin2hex(random_bytes(16)); }

Prevention

When it happens

Trigger: Legacy code called session_start() inside a worker process (FPM-style code reused in Workerman), or a bundled library opens the native session before a new session id must be created for a client without a session cookie.

Common situations: Porting an FPM application to Workerman; a composer package that calls session_start()/session_id() lazily; phpunit/bootstrap that started a session in the same process during tests.

Related errors

AI-assisted analysis of walkor/workerman@1391112a61 (2026-08-21). Data as JSON: /api/errors/02dbcfc9fc36df03. Report an issue: GitHub.