SessionNameChangedWhileActive

warning native on by default

Group: Probable bugs

A session name must be configured before the session becomes active. Set the name before starting the session.

Example

<?php
session_start(); session_name("CUSTOM");

Reported:

• line 2: Set the session name before starting the session.

Detection

• Resolved session_start in straight-line scope precedes session_name setter before any session_write_close/session_abort/session_destroy. Require definite active state; unknown calls invalidate proof.
• Resolve builtin functions, classes, constants and methods; user-defined lookalikes are excluded. Follow only bounded local proof in one lexical scope.
• Emit one finding per violating operation, not per supporting evidence statement. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Do not report unresolved or shadowed builtin names, unknown values, or incomplete receiver/type provenance. Unknown calls, aliases escaping, and intervening writes invalidate local proof. Similar code outside the stated detection contract is not a finding.
• A session_start call with read_and_close true does not establish an active session. Unknown option values discard active-state proof.
• E1b. From PHP 8.0 the name parameter is nullable and a null argument only reads the current name, exactly like the argument-less call. A positional or named argument that resolves to the null constant (directly or through a locally proven variable) is therefore not a setter when the target version is 8.0 or later. Before 8.0 null is coerced to a string and takes the setter path, so the call is still reported.
• Both standard suppression forms suppress this native ID.

Fix

None. Choosing a repair requires intent or additional runtime information.

PHP versions

Available throughout supported PHP 5.3–8.5 where the referenced builtin/extension is available. The null-argument getter form (E1b) is recognized from PHP 8.0 only. Respect syntax/version-specific receiver contracts; unavailable APIs are not this rule’s concern.

Configure

In custos.json:

{
  "rules": {
    "SessionNameChangedWhileActive": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore SessionNameChangedWhileActive