SessionIdInterface
was created as part of php-src pull request 109 and landed in PHP 5.5.1. Some details on it are discussed there.
In short, your SessionHandlerInterface
implementation may also implement SessionIdInterface
and provide a create_sid
method that returns a string. PHP will automatically invoke create_sid
instead of using the internal session creation functions as defined in php.ini.
Here's an example script that demonstrates the use.
<?php
class SillySessionHandler implements SessionHandlerInterface, SessionIdInterface {
static $lol_sessions = [];
public function open($save_path, $filename) { return true; }
public function close() { return true; }
public function destroy($session_id) { return true; }
public function gc($lifetime) { return true; }
public function read($session_id) {
return array_key_exists($session_id, static::$lol_sessions) ? static::$lol_sessions[$session_id] : null;
}
public function write($session_id, $session_data) {
static::$lol_sessions[$session_id] = $session_data;
echo "Session data: ", $session_data;
}
public function create_sid() {
$sid = bin2hex(openssl_random_pseudo_bytes(16));
static::$lol_sessions[$sid] = [];
return $sid;
}
}
$handler = new SillySessionHandler;
session_set_save_handler($handler, true);
session_start();
echo "Your session ID is ", session_id(), "<hr>";
$_SESSION['foo'] = 'bar';
Example output:
Your session ID is 2e837e0c5f5ac1b23296d384a9aab2af
Session data: foo|s:3:"bar";