PHP session handling errors

Question

I have this at the very top of my send.php file:

ob_start();
@session_start();

//some display stuff

$_SESSION['id'] = $id; //$id has a value
header('location: test.php');

And the following at the very top of my test.php file:

ob_start();
@session_start();

error_reporting(E_ALL);
ini_set('display_errors', '1');

print_r($_SESSION);

When the data sends to test.php, the following is displayed:

Array ( )

Warning: Unknown: open(/var/lib/php/session/sess_isu2r2bqudeosqvpoo8a67oj02, O_RDWR) failed: Permission denied (13) in Unknown on line 0

Warning: Unknown: Failed to write session data (files). Please verify that the current setting of session.save_path is correct (/var/lib/php/session) in Unknown on line 0

I've tried only using session_start(); but the results are the same.

I am not sure if this is exact solution to your problem. But, Since you are not displaying anything before you are processing in the `test.php`, IMO you should try to use ob_end_flush(); at the end of `send.php` and remove the `ob_start();` at test.php — Starx, Feb 24 '11 at 11:41
possible duplicate of [PHP session permission problem](http://stackoverflow.com/questions/2058994/php-session-permission-problem) — mario, Feb 24 '11 at 11:52
I'm currently wondering if it would help if PHP did output such error messages wrapped in `` per default. — mario, Feb 24 '11 at 11:56
Today I was getting same error and I solved by **reset setting to default** in Chrome. — Abhishek Kamal, Mar 29 '20 at 06:47

score 36 · Answer 1 · edited Jun 19 '19 at 09:57

Look at your message

So first thing it relate to permission

open(/var/lib/php/session/sess_isu2r2bqudeosqvpoo8a67oj02, O_RDWR) failed: Permission denied (13) in Unknown on line 0

you have to check file permission change mode this /var/lib/php/session/

Second thing it relate to session.save_path

Warning: Unknown: Failed to write session data (files). Please verify that the current setting of session.save_path is correct (/var/lib/php/session) in Unknown on line 0

in php.ini

[Session]
; Handler used to store/retrieve data.
session.save_handler = files

; Argument passed to save_handler. In the case of files, this is the path
; where data files are stored. Note: Windows users have to change this
; variable in order to use PHP's session functions.
; 
; As of PHP 4.0.1, you can define the path as:
; 
;     session.save_path = "N;/path"
; 
; where N is an integer. Instead of storing all the session files in
; /path, what this will do is use subdirectories N-levels deep, and
; store the session data in those directories. This is useful if you
; or your OS have problems with lots of files in one directory, and is
; a more efficient layout for servers that handle lots of sessions.
; 
; NOTE 1: PHP will not create this directory structure automatically.
;         You can use the script in the ext/session dir for that purpose.
; NOTE 2: See the section on garbage collection below if you choose to
;         use subdirectories for session storage
;
session.save_path = /tmp/    <= HERE YOU HAVE TO MAKE SURE

; Whether to use cookies.
session.use_cookies = 1

this works but when the server is rebooted it seems to be gone back to the old way of 0666 and own by 'root' how to fix that ? — mahen3d, Jun 16 '15 at 01:52

Your Common Sense · Answer 2 · 2011-02-24T12:01:42.790

15

you have to change your session.save_path setting to the accessible dir, /tmp/ for example

How to change: http://php.net/session_save_path

Being on the shared host, it is advised to set your session save path inside of your home directory but below document root

also note that

using ob_start is unnecessary here,
and I am sure you put @ operator by accident and already going to remove it forever, don't you?

edited Feb 24 '11 at 12:01

answered Feb 24 '11 at 11:36

Your Common Sense

156,878
40
214
345

1

i would also like to know how – S L Feb 24 '11 at 11:38
1

Can this be changed through the script?, or the `php.ini` has to be edited. – Starx Feb 24 '11 at 11:42
Is it always and with 100% certainty wrong to store sessions in a sub-directory of `/var/lib/php/`? (I'm not a Unix/Linux guru, so I don't know.) Somebody has to have specifically set this at some point – Pekka Feb 24 '11 at 12:00
2

@Pekka sure. /var usually being mounted on the separate partition with limited size, not to mention other security issues – Your Common Sense Feb 24 '11 at 12:30

score 11 · Answer 3 · answered Jun 14 '12 at 14:14

11

This was a known bug in version(s) of PHP . Depending on your server environment, you can try setting the sessions folder to 777:

/var/lib/php/session (your location may vary)

I ended up using this workaround:

session_save_path('/path/not/accessable_to_world/sessions');
ini_set('session.gc_probability', 1);

You will have to create this folder and make it writeable. I havent messed around with the permissions much, but 777 worked for me (obviously).

Make sure the place where you are storing your sessions isn't accessible to the world.

This solution may not work for everyone, but I hope it helps some people!

answered Jun 14 '12 at 14:14

roberthuttinger

1,172
1
17
31

That is probably the best way to go, however which one is **THE** one to send people to? and is posting "go look here" __really__ an answer? The answer is relevant if not timely. Is there some __rule__ about this I am unaware of? It isn't spamming if is it relevant and succinct. I think this answer is appropriate and straightforward. – roberthuttinger Jun 14 '12 at 16:04
It is spamming if it's the *same* thing all the time. That said, if the questions are duplicates, then flag them as duplicates and we'll take a look at it. If they are legitimately *not* duplicates, then since this involves a bug report, leave a *comment on the question* indicating that it's a bug and then flag for it being too localized. – casperOne Jun 14 '12 at 16:18
4

From the [first comment](http://stackoverflow.com/questions/5104065/php-session-handling-errors/11034977#comment14431008_11034977) (emphasis mine): "If the questions are duplicates, find the one canonical answer and answer that, and then **flag the others for moderator attention, indicating they are duplicates**." – casperOne Jun 14 '12 at 18:14
1

Setting the folder to 777 permissions should only be a quick fix, as it could potentially cause a security risk. See my answer for a more complete and secure solution. – Dan Bray May 07 '18 at 20:45

Dan Bray · Answer 4 · 2020-10-21T21:02:33.433

You can fix the issue with the following steps:

Verify the folder exists with sudo cd /var/lib/php/session. If it does not exist then sudo mkdir /var/lib/php/session or double check the logs to make sure you have the correct path.
Give the folder full read and write permissions with sudo chmod 666 /var/lib/php/session.

Rerun you script and it should be working fine, however, it's not recommended to leave the folder with full permissions. For security, files and folders should only have the minimum permissions required. The following steps will fix that:

You should already be in the session folder so just run sudo ls -l to find out the owner of the session file.
Set the correct owner of the session folder with sudo chown user /var/lib/php/session.
Give just the owner full read and write permissions with sudo chmod 600 /var/lib/php/session.

NB

You might not need to use the sudo command.

Why `700` (7=rwx)? Is "execute" really necessary here? Setting permissions to `600` (rw) should actually work too? — Awaaaaarghhh, Oct 21 '20 at 06:45

score 5 · Answer 5 · edited Oct 04 '12 at 09:13

5

Go to your PHP.ini file or find PHP.ini EZConfig on your Cpanel and set your session.save_path to the full path leading to the tmp file, i.e: /home/cpanelusername/tmp

edited Oct 04 '12 at 09:13

Littm

4,923
4
30
38

answered Oct 04 '12 at 07:25

siveict.co.za

51
1
1

score 1 · Answer 6 · answered Jun 10 '15 at 08:41

1

I had the same error everything was correct like the setting the folder permissions.

It looks like an bug in php in my case because when i delete my PHPSESSID cookie it was working again so aperently something was messed up and the session got removed but the cookie was still active so php had to define the cause differently and checking first if the session file is still they and give another error and not the permission error

answered Jun 10 '15 at 08:41

Danny van der Knaap

19
6

I was just having a similar problem. Site worked on one PC, and not on the other. Deleting the `PHPSESSID` cookie solved the problem. Though, I still don't know what the actual problem is. – akinuri Apr 09 '19 at 11:13

score 1 · Answer 7 · answered Sep 27 '17 at 15:21

1

When using latest WHM (v66.0.23) you may go to MultiPHP INI Editor choose PHP version and set session.save_path to default i.e. /var/cpanel/php/sessions/ea-php70 instead of previous simple tmp - this helped me to get rid of such errors.

answered Sep 27 '17 at 15:21

Iggy

2,014
25
21

Daniel Kutik · Answer 8 · 2011-02-24T11:47:57.523

1

please make sure the session.save_path is set correctly in the php.ini. php needs read/write access to the directory to which this variable is set.

more information: http://www.php.net/manual/en/session.configuration.php#ini.session.save-path

edited Feb 24 '11 at 11:47

answered Feb 24 '11 at 11:39

Daniel Kutik

6,997
2
27
34

1

I wouldn't recommend a latter one. – Your Common Sense Feb 24 '11 at 11:40

score 0 · Answer 9 · answered Apr 21 '13 at 09:20

When using the header function, php does not trigger a close on the current session. You must use session_write_close to close the session and remove the file lock from the session file.

ob_start();
@session_start();

//some display stuff

$_SESSION['id'] = $id; //$id has a value
session_write_close();
header('location: test.php');

score 0 · Answer 10 · answered Jul 12 '13 at 13:14

0

check your cpanels space.remove unused file or error.log file & then try to login your application(This work for me);

answered Jul 12 '13 at 13:14

pankaj

1

score 0 · Answer 11 · answered Jun 03 '15 at 22:12

I got these two error messages, along with two others, and fiddled around for a while before discovering that all I needed to do was restart XAMPP! I hope this helps save someone else from the same wasted time!

Warning: session_start(): open(/var/folders/zw/hdfw48qd25xcch5sz9dd3w600000gn/T/sess_f8bgs41qn3fk6d95s0pfps60n4, O_RDWR) failed: Permission denied (13) in /Applications/XAMPP/xamppfiles/htdocs/foo/bar.php on line 3

Warning: session_start(): Cannot send session cache limiter - headers already sent (output started at /Applications/XAMPP/xamppfiles/htdocs/foo/bar.php:3) in /Applications/XAMPP/xamppfiles/htdocs/foo/bar.php on line 3

Warning: Unknown: open(/var/lib/php/session/sess_isu2r2bqudeosqvpoo8a67oj02, O_RDWR) failed: Permission denied (13) in Unknown on line 0

Warning: Unknown: Failed to write session data (files). Please verify that the current setting of session.save_path is correct (/var/lib/php/session) in Unknown on line 0

score 0 · Answer 12 · answered Dec 10 '15 at 11:17

I'm using php-5.4.45 and I got the same problem.

If you are a php-fpm user, try edit php-fpm.conf and change listen.owner and listen.group to the right one. My nginx user is apache, so here I change these to params to apache, then it works well for me.

For apache user, I guess you should edit your fast-cgi params refer the two params I mention above.

score 0 · Answer 13 · answered Jan 08 '16 at 19:59

If you use a configured vhost and find the same error then you can override the default setting of php_value session.save_path under your <VirtualHost *:80>

#
# Apache specific PHP configuration options
# those can be override in each configured vhost
#
php_value session.save_handler "files"
php_value session.save_path    "/var/lib/php/5.6/session"
php_value soap.wsdl_cache_dir  "/var/lib/php/5.6/wsdlcache"

Change the path to your own '/tmp' with chmod 777.

PHP session handling errors

13 Answers13

Linked