[session] abort strict-mode re-creation when create_sid fails - #286
Open
iliaal wants to merge 1 commit into
Open
[session] abort strict-mode re-creation when create_sid fails#286iliaal wants to merge 1 commit into
iliaal wants to merge 1 commit into
Conversation
When a save handler rejects the session ID in strict mode, the re-created ID must be non-NULL or initialization must fail; previously a failing s_create_sid() was silently papered over by generating a fresh internal ID and continuing, running reset_id() side effects (Set-Cookie, SID constant) for a session that then failed to start, and proceeding with a NULL PS(id) if the fallback generation also failed. Mirror the primary no-ID branch's abort/error handling; sibling call sites audited: session_regenerate_id() collision loop and session_create_id() already NULL-check with their own error paths, mod_mm's strict re-create returns FAILURE into the initialize abort path.
iliaal
force-pushed
the
fix/session-strict-recreate-abort-84
branch
from
August 26, 2026 12:57
e3743b9 to
51966ff
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Strict-mode session_start(): when validateId() rejected the incoming ID the re-creation branch released PS(id), called s_create_sid(), substituting a fresh internal ID on failure instead of aborting like the primary no-ID branch; a failed fallback left PS(id) NULL and startup skipped s_close(). Recoverable cases ran reset_id()'s Set-Cookie and SID side effects before the pending exception broke s_read(). create_sid() failures are now fatal during strict-mode re-creation; a test asserts no SID artifact survives a failed start, and siblings handle their own errors. Split-out follow-up: #303.