You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Should the absence of create_sid() method generate a DEPRECATED instead of WARNING message? #23547
When using a custom session handler in PHP 8.6.0beta2 I get the following message:
PHP Warning: Class MyNamespace\SessionHandlerDb implementing SessionHandlerInterface is missing the create_sid() method which will be required in PHP 9.0
Is a WARNING a bit harsh? It's also not consistent with the level of message from session_set_save_handler():
PHP Deprecated: session_set_save_handler(): Providing an object to argument #1 ($sessionhandler) which does not have the create_sid() method defined is deprecated
And the following warning will be emitted when implementing SessionHandlerInterface on a class which doesn't define the create_sid() or validateId() methods:
I don't think this should be an E_DEPRECATED as this issue should be sorted ASAP considering it has security implications relating to sessions more broadly.
Activity
NickSdot commentedon Sep 3, 2026
ref: #23298
Girgias commentedon Sep 5, 2026
The RFC stipulates a warning:
I don't think this should be an E_DEPRECATED as this issue should be sorted ASAP considering it has security implications relating to sessions more broadly.