|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #71162 updateTimestamp is called always when session is empty
Submitted: 2015-12-18 22:54 UTC Modified: 2017-10-24 03:06 UTC
Avg. Score:2.0 ± 1.0
Reproduced:0 of 0 (0.0%)
From: e2c2be7ed0f2f336 at gmail dot com Assigned: yohgaki (profile)
Status: Assigned Package: Session related
PHP Version: 7.0Git-2015-12-18 (snap) OS:
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
Block user comment
Status: Assign to:
Bug Type:
From: e2c2be7ed0f2f336 at gmail dot com
New email:
PHP Version: OS:


 [2015-12-18 22:54 UTC] e2c2be7ed0f2f336 at gmail dot com
A session which remains empty always invoke the write callback instead of updateTimestamp of the session handler.

Not really a bug but behavior would be more consistent.

Test script:

Expected result:

Actual result:


proposal_for_bug_71162 (last revision 2015-12-18 23:05 UTC by e2c2be7ed0f2f336 at gmail dot com)

Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2015-12-20 00:10 UTC]
-Assigned To: +Assigned To: yohgaki
 [2015-12-20 00:10 UTC]
Current session module is designed to write empty session always. I don't think I can change to update time stamp for empty session. (Session module cannot know empty session is new one or not, currently. Session module may detect it, though. This requires yet another state management which is rather complicated already.)

Other than this, I noticed session_set_save_handler() changed the way not to accept SessionIdHandlerInterface nor SessionUpdateTimestampHandlerInterface by someone else.

Therefore, there is no way to use object version of save handler implements SessionIdHandlerInterface or SessionUpdateTimestampHandlerInterface. 

Other parts of object based user save handler implementation needs clean up also. Assign this bug to me for session module clean up in the future.
 [2015-12-20 02:43 UTC]
-Summary: lazy_write never call updateTimestamp when session remains empty +Summary: updateTimestamp is called always when session is empty
 [2016-01-15 21:47 UTC]
-Status: Assigned +Status: Analyzed
 [2016-01-15 21:47 UTC]
I cannot change "php" serialize handler's behavior, but you may use "php_serialize" handler. 


It saves 


for empty $_SESSION and timestamp would work.

So this bug could be considered as feature request for setting "php_serialize" as the default serialize handler. "php_serialize" does not have restrictions for session variables names also. It should be the default.
 [2017-10-24 03:06 UTC]
-Status: Analyzed +Status: Assigned
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Fri Jul 19 16:01:30 2024 UTC