SessionRegenerationFailureUnchecked

warning native off by default

Group: Security

Session identifier regeneration can fail. Check its result before establishing the configured authenticated session state. This inspection is disabled by default because the intended policy or use can vary.

Example

<?php
session_regenerate_id(true); $_SESSION["authenticated"]=true;

Reported:

• line 2: Check session identifier regeneration before authenticating.

Detection

• Resolved session_regenerate_id result is discarded immediately before assignment of true to a configured authentication session key (default authenticated). Require explicit $_SESSION literal key and no result guard; ordinary regeneration excluded. The result is still discarded when the call statement is wrapped in parentheses or silenced with the @ operator, in any nesting: suppressing the warning does not check the outcome. Any other wrapper (negation, cast, assignment, output) uses the result and is not reported.
• Resolve builtin functions, classes, constants and methods; user-defined lookalikes are excluded. Follow only bounded local proof in one lexical scope.
• Emit one finding per violating operation, not per supporting evidence statement. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Do not report unresolved or shadowed builtin names, unknown values, or incomplete receiver/type provenance. Unknown calls, aliases escaping, and intervening writes invalidate local proof. Similar code outside the stated detection contract is not a finding.
• Both standard suppression forms suppress this native ID.

Fix

None. Choosing a repair requires intent or additional runtime information.

PHP versions

Available throughout supported PHP 5.3–8.5 where the referenced builtin/extension is available. Respect syntax/version-specific receiver contracts; unavailable APIs are not this rule’s concern.

Options

Option	Type	Default	Effect
authenticationKeys	list	["authenticated"]	$_SESSION keys whose assignment of true marks a login; only regeneration right before such an assignment is checked.

Configure

In custos.json:

{
  "rules": {
    "SessionRegenerationFailureUnchecked": {
      "enabled": true,
      "options": {
        "authenticationKeys": ["authenticated"]
      }
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore SessionRegenerationFailureUnchecked