is there any other script on your site/app that does any session manipulation outside of symfony's control?

yes. it could be concurrency issue. there is a PR to enable session locking for PDO sessions . it's not been merged yet though.

native storage should already do file locking.

I have overwritten the NativeSessionStorage. However, I don't think this would be causing an issue. Here is the code:

<?php

namespace Acme\DemoBundle\Session;

use Symfony\Component\DependencyInjection\ContainerInterface;
use Symfony\Component\HttpFoundation\RequestStack;
use Symfony\Component\HttpFoundation\Session\Storage\NativeSessionStorage;

class Storage extends NativeSessionStorage
{
    /**
     * @var RequestStack
     */
    protected $requestStack;

    /**
     * @param ContainerInterface $container
     */
    public function setRequestStack(RequestStack $requestStack)
    {
        $this->requestStack = $requestStack;
    }

    /**
     * {@inheritdoc}
     */
    public function start()
    {
        if ($this->started && !$this->closed) {
            return true;
        }

        $request = $this->requestStack->getCurrentRequest();
        if ('acme_demo.session.id' === $request->get('_route')) {
            if ($request->query->has('sessionId') && $request->query->get('sessionId')) {
                session_id($request->query->get('sessionId'));
            }
        }

        parent::start();
    }
}

@trsteel88 would be good if you confirmed that the original NativeSessionStorage class suffers the same propblem. Also, without a reproducible scenario or code we won't be able to help quickly.

I have removed my Compiler Pass which overrides the session. The issue is still occurring.

fyi, I am using LiipImagineBundle so it is possible multiple requests are trying to access the session at once when images are loading.

fyi, here is the error log:

[2014-08-19 20:34:12] request.INFO: Matched route "app_core.event.create"
(parameters: "_controller": "App\CoreBundle\Controller
EventController::createAction", "_route": "app_core.event.create") [] []
[2014-08-19 20:34:12] security.DEBUG: Remember-me cookie detected. [] []
[2014-08-19 20:34:12] security.INFO: Remember-me cookie accepted. [] []
[2014-08-19 20:34:12] security.DEBUG: SecurityContext populated with
remember-me token. [] []
[2014-08-19 20:34:12] request.CRITICAL: Uncaught PHP Exception
RuntimeException: "Failed to start the session: already started by PHP." at
/application/releases/20140819043926/app/cache/prod/classes.php
line 113 {"exception":"[object](RuntimeException: Failed to start the
session: already started by PHP. at /application/
releases/20140819043926/app/cache/prod/classes.php:113)"} []

I have only ever seen this happen when a remember me cookie is detected.

It personally just happened to me. I logged in through Facebook on the
website so there shouldn't have been a remember me cookie involved.

@trsteel88 is this something you could reproduce on a clean Symfony installation?

I haven't seen this issue before. Although this is the first site that is attracting quite a few simultaneous users.

I have just updated the config.yml so it has the handler_id set to ~ as per https://github.com/symfony/symfony-standard/blob/master/app/config/config.yml

Should this make a difference?

By doing this you'll make Symfony use the default session handler from your php.ini.

I'm not sure how it's going to influence your bug, as I still didn't manage to reproduce it.

Does "~" mean null? I thought ~ just meant "default" value in the Configuration.

It means null in yaml. This is usually treated as "take the default value" by Configuration classes.

Ah right. Hmm, this has me stumped. Is there anything that could be starting the session when it has already been started somewhere else?

Unless there's really a bug, but I really can't see how a session could be started twice in Symfony. There must be something you're doing in your code.

I encourage you to start with a fresh installation of Symfony, introduce the bundles you use and a simple controller which would reproduce the problem. I don't know what's inside your project and won't be able to help or fix the bug without a reproducible scenario.

P.S. run php app/check.php just to make sure your environment is configured properly, specifically the session.auto_start is off.

Yeah I checked the auto_start. It is set to Off. Thanks for your help. I will have to dig a bit deeper.

Is the only way it would start through session->start() or session_start()?

I may have found the culprit: https://github.com/facebook/facebook-php-sdk/blob/v3.2.3/src/facebook.php#L48

I may have to update to master where they check if the session is active: https://github.com/facebook/facebook-php-sdk/blob/master/src/facebook.php#L58

I will let you know if this solves the problem.

fyi, this did not solve the issue. I will have to continue looking.

I think I may have found the issue. I had a factory which would create the Facebook instance. It seems that Facebook may have been initialising the session before Symfony could. To solve this I am now injecting the SessionInterface into my factory and initialising it before creating the Facebook api instance.

/**
     * @return \Facebook
     */
    public function get()
    {
        if (null === $this->api) {
            if (!$this->session->isStarted()) {
                // Start the session so Facebook class does not start it
                $this->session->start();
            }

            $this->api = new \Facebook(array(
                'appId'  => $this->appId,
                'secret' => $this->secret,
            ));
        }

        return $this->api;
    }

@1emming, sorry for the late reply.

I guess the documentation should stress that the session needs to be started before any other library. I guess this would involve creating a Factory which injects the SessionInterface and starts the session before anything else.

I think Im having the same error but just in production. In my local installation Im not getting this.

[2014-12-17 11:31:57] request.CRITICAL: Uncaught PHP Exception RuntimeException: "Failed to start the session: already started by PHP ($_SESSION is set)." at ...evaluacion_daci/app/cache/prod/classes.php line 100 {"exception":"[object] (RuntimeException: Failed to start the session: already started by PHP ($_SESSION is set). at ../public_html/evaluacion_daci/app/cache/prod/classes.php:100)"} []

When I get this error is when I try to initialize a new Session in order to set a flashbag message. This is the code that raises my error.

$session = new Session();
        $session->getFlashBag()->add('notice', $mesage);
        return $this->redirect($this->generateUrl("dacicontratos_eval_main"));

Any idea how to solve this?

@RodolVelasco Why do you create a new session and don't retrieve it from the current request instead?

@xabbuh . You were right. Now its solved.

I think Im having the same error but just in production. In my local installation Im not getting this.

[2014-12-17 11:31:57] request.CRITICAL: Uncaught PHP Exception RuntimeException: "Failed to start the session: already started by PHP ($_SESSION is set)." at ...evaluacion_daci/app/cache/prod/classes.php line 100 {"exception":"[object] (RuntimeException: Failed to start the session: already started by PHP ($_SESSION is set). at ../public_html/evaluacion_daci/app/cache/prod/classes.php:100)"} []

When I get this error is when I try to initialize a new Session in order to set a flashbag message. This is the code that raises my error.

$session = new Session();
        $session->getFlashBag()->add('notice', $mesage);
        return $this->redirect($this->generateUrl("dacicontratos_eval_main"));

Any idea how to solve this?

I have the same problem

private $session;

public function __construct(){
$this->session = new Session();
}

Warning: session_cache_limiter(): Cannot change cache limiter when session is active

@AzazelOnni777 #11612 (comment)