Fix reusing the previous session ID in Session::open() in long-running workers

CHANGELOG.md

@@ -4,6 +4,7 @@
 
 - Enh #86: Remove `yiisoft/cookies` dependency (@vjik)
 - Bug #86: `NullSession::getCookieParameters()` now returns proper cookie parameters instead of an empty array (@vjik)
+- Bug #25: Fix reusing the previous session ID in `Session::open()` in long-running workers  (@klsoft-web)
 
 ## 3.0.2 August 26, 2026
 

src/Session.php

@@ -5,6 +5,7 @@
 namespace Yiisoft\Session;
 
 use SessionHandlerInterface;
+use SessionHandler;
 use Throwable;
 
 use const PHP_SESSION_ACTIVE;
@@ -37,14 +38,14 @@
 
     /**
      * @param array $options Session options. See {@link https://www.php.net/manual/en/session.configuration.php}.
-     * @param SessionHandlerInterface|null $handler Session handler. If not specified, default PHP handler is used.
+     * @param SessionHandlerInterface|SessionHandler|null $handler Session handler. If not specified, default PHP handler is used.
      *
      * @psalm-param SessionOptions $options
      */
-    public function __construct(array $options = [], ?SessionHandlerInterface $handler = null)
+    public function __construct(array $options = [], private SessionHandlerInterface|SessionHandler|null $handler = null)
     {
-        if ($handler !== null) {
-            session_set_save_handler($handler, true);
+        if ($this->handler !== null) {
+            session_set_save_handler($this->handler, true);
         }
 
         // We set cookies using SessionMiddleware.
@@ -94,6 +95,8 @@
 
         if ($this->sessionId !== null) {
             session_id($this->sessionId);
+        } else if ($this->handler instanceof SessionHandler) {
+            session_id($this->handler->create_sid());
         }
 
         try {

tests/MockSessionId.php

@@ -0,0 +1,17 @@
+<?php
+
+namespace Yiisoft\Session\Tests;
+
+use SessionHandler;
+
+final class MockSessionId extends SessionHandler
+{
+    public function __construct(private string $sessionId)
+    {
+    }
+
+    public function create_sid(): string
+    {
+        return $this->sessionId;
+    }
+}

tests/SessionTest.php

@@ -94,6 +94,19 @@ public function testRegenerateIdOpensInactiveSession(): void
         self::assertNotEquals($id, $session->getId());
     }
 
+    public function testOpenDoesNotReuseIdOfClosedSession(): void
+    {
+        $firstSession = new Session([], new MockSessionId('first-session-id'));
+        $firstSession->open();
+        $firstId = $firstSession->getId();
+        $firstSession->close();
+
+        $secondSession = new Session([], new MockSessionId('second-session-id'));
+        $secondSession->open();
+
+        self::assertNotSame($firstId, $secondSession->getId());
+    }
+
     public function testDiscard(): void
     {
         $session = $this->getSession();