PHP session problem: each session_start() gets a new session

Question

I am upgrading from PHP 7.3 to 8.1. To do this I have two separate environments; one for each level of PHP. Up until a few days ago the project was proceeding as expected. Then suddenly the PHP 8.1 environment session handling broke.

The problem that just started happening is that each time session_start() is called, a different session id is used, thus killing the previous session data. We have a custom session handler, which is identical in the two code bases.

We have been frequently updating the code in both environments to keep them pretty close together. And since this just started happening, the two code bases are very similar.

Here are some of the things I have checked:

• checked the code between the two versions. There are some differences but nothing that should affect the sessions;
• looked for browser output prior to the call to session_start() that has snuck in to the 8.1 code base, such as bogus characters before the <?php open tag;
• checked that the session table can be written;
• disabled certain functions such as error handling and ajax calls that could be affecting the issue;
• checked that cookies are not blocked, which would impact session handling;
• checked multiple browsers on the 8.1 environment;
• compared the php.ini files in the two environments, especially with regard to session parameters.

So we have two code bases, both of which ran as expected, but now with this major difference.

Looking at the code for the session handling, the situation is that "it works over here, but not over there".

Here is the code:

//create custom session handler object
$handler = new RHSessionHandler();
session_cache_limiter('');
session_set_save_handler($handler, true);
session_set_cookie_params(3600, null, null, true, true);
session_start();
$session_id = session_id();

I might guess that there is something different between the two environments that we have not yet detected, but it would have to be something that changed in the last few working hours. There are no such changes that I know of.

EDIT

After setting this aside for a while, then coming back to it, suddenly the sessions behaved normally for about a half hour. But then after that time period, the malfunctioning started occurring again.

There were only some small code changes, which I reverted, plus a system reboot. Trying those small changes and another reboot has not removed the issue. More mystery.

EDIT 2:

Continuing to work on this I first rebooted the virtual machine and retested. Still not continuing the session but starting a new one. Then I decided to add some innocuous code for diagnostics. I added $isExistingSessionId = session_id(); right before the call to session start. Since there should be no session yet, it should be empty. But suddenly, the sessions started working again!

Not sure if this is "random" or had something to do with the jiggering the code. So I commented that new line out, and the sessions continue to work properly. Then deleted the commented line; still working properly. Not sure what to make of this.

Right now the closest thing to a pattern is the following:

1. Reboot the VM (effect of which might also be accomplished by just restarting apache).
2. Test--sessions still not working.
3. Wait about 5 minutes.
4. Sessions start working.
5. After a while, sessions don't work again.

EDIT 4

I have found a temporary workaround that allows me to continue to work on the upgrade to PHP 8.1, but that won't work in production.

The workaround is to set a specific session id before the call to session_start(). That way it keeps that one specific session.

As far as my immediate work, I can move forward. My hope is the cause of the problem pertains to my test environment, which is a local virtual machine that connects to a development database on another server.

The idea is that in a different environment, PHP sessions will just be working and this issue is only an artifact of my local environment. The workaround will not work in production, because each visitor has to have their own session.