|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Doc Bug #71289 Using session_name() prevents session_progress features from working
Submitted: 2016-01-05 17:08 UTC Modified: 2021-09-24 13:56 UTC
From: pfenderd at bellsouth dot net Assigned: cmb (profile)
Status: Duplicate Package: Session related
PHP Version: irrelevant OS: any
Private report: No CVE-ID: None
 [2016-01-05 17:08 UTC] pfenderd at bellsouth dot net
Using session_name() to specify a name immediately before session_start() causes the session_progress feature to indicate that an upload has completed immediately even though the file is still being sent.  In my test case, the only difference between a working version and the failed version is the used of session_name().

Without using session_name(), the session_progress feature works very well.

I currently use session_name() to differentiate sessions when using the same browser to access different web pages in different tabs that show data from different websites on the same server.  This feature works well except for the session_progress feature.

Test script:
$session_name_str = "upload_session";


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2016-01-05 18:19 UTC] pfenderd at bellsouth dot net
When I mentioned session_progress, I was referring to the session.upload_progress feature.
 [2016-01-06 22:04 UTC] pfenderd at bellsouth dot net
The problem is a little bit more complicated than first thought. When a browser is first opened and a session started using session_name() before session_start() the problem will continue to occur.  However, if a session is opened without using session_name() just once, then thereafter the use of session_name() will not cause a problem.  This is repeatable with IE 11, Firefox 43.0.4, Chrome 47.0.2526.106  and Opera 34.0.2036.31.
Test using session_name():
Test without using session_name():

The only difference between these two test URLs is the use of session_name() or not.
Closing the browser and opening the browser again creates the problem situation.
 [2016-01-07 01:44 UTC] pfenderd at bellsouth dot net
More on the problem conditions:  To make the session_name() function work with session.upload_progress, the session first needs to be started without using session_name() AND also a file upload needs to be done.  Once the first file has been uploaded, then it is safe to use session_name() and the progress feature will work properly.
Test using session_name():
Test without using session_name():
 [2016-01-07 05:09 UTC]
-Status: Open +Status: Analyzed -Type: Bug +Type: Feature/Change Request -Operating System: Windows 7 +Operating System: any -PHP Version: 7.0.1 +PHP Version: irrelevant
 [2016-01-07 05:09 UTC]
The reason why changing session name after module initialization does not work is the way RFC 1867 callback implemented.

Upload progress callback (php_rfc1867_callback) is registered when session module is initialized. It is used when RFC 1867 upload is performed and handled in main/rfc1867.c. 

This means changing session name in user script is too late to make it work. I think it does not work in older versions also, does it?

Possible fix would be delaying file upload handling and/or handle file upload manually. PHP handles file uploading automatically now. Anyway, user cannot make use of session_name('NEW_NAME')/ini_set('', 'NEW_NAME') to use multiple file upload progress handling. 

I checked the code briefly. Please correct me if I'm wrong.
 [2016-01-07 05:14 UTC]
Possible work around is to set in .htaccess. "php_value" directive is processed before uploaded file handling. If you use .htaccess (or like) to set different session name, it should work. You'll need individual files, at least symlink, though.
 [2016-01-07 05:20 UTC]
-Summary: Using session_name() prevents session_progress features from working +Summary: JIT $_FILES initilization is required for multiple to work
 [2016-01-20 16:19 UTC] pfenderd at bellsouth dot net
Is there a difference in how sessions are handled using the API or the fast CGI on the server side?  My testing has been on Windows 7 using IIS 7.5.  If there is a difference in the server type of session handling, then this should be well documented so programmers can deal with it.

The problem has nothing to do with multiple files being uploaded, only a single file.
 [2021-09-24 13:56 UTC]
-Summary: JIT $_FILES initilization is required for multiple to work +Summary: Using session_name() prevents session_progress features from working -Status: Analyzed +Status: Duplicate -Type: Feature/Change Request +Type: Documentation Problem -Assigned To: +Assigned To: cmb
 [2021-09-24 13:56 UTC]
Like Yasuo said, uploads are processed before any scripts are
actually executed.  When an upload is in progress, the respective
data are written to the session as specified in php.ini, and
$_SESSION is populated.  If you change the session name and then
start a session, the upload data are therefore no longer available
in $_SESSION. The cleanest solution is to set the desired prior to script execution.  If that is not possible
for whatever reason, you can work around with something like:

    if (isset($_SESSION)) {
        $upload_data = $_SESSION;
    $_SESSION = array_merge($_SESSION, $upload_data);

Thus, this is merely a doc problem, and hence a duplicate of bug
PHP Copyright © 2001-2023 The PHP Group
All rights reserved.
Last updated: Fri Jun 02 16:03:42 2023 UTC