Skip to content

Should the absence of create_sid() method generate a DEPRECATED instead of WARNING message? #23547

Closed as not planned

Description

@campbell-m

Description

When using a custom session handler in PHP 8.6.0beta2 I get the following message:

PHP Warning: Class MyNamespace\SessionHandlerDb implementing SessionHandlerInterface is missing the create_sid() method which will be required in PHP 9.0

Is a WARNING a bit harsh? It's also not consistent with the level of message from session_set_save_handler():

PHP Deprecated: session_set_save_handler(): Providing an object to argument #1 ($sessionhandler) which does not have the create_sid() method defined is deprecated

PHP Version

PHPP 8.6.0beta2

Operating System

Windows

Activity

  1. added this to the PHP 8.6 milestone on Sep 2, 2026
  2. NickSdot commented on Sep 3, 2026

    @NickSdot
    Contributor

    ref: #23298

  3. Girgias commented on Sep 5, 2026

    @Girgias
    Member

    The RFC stipulates a warning:

    And the following warning will be emitted when implementing SessionHandlerInterface on a class which doesn't define the create_sid() or validateId() methods:

    I don't think this should be an E_DEPRECATED as this issue should be sorted ASAP considering it has security implications relating to sessions more broadly.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions