error when saving php sessions in project's di

Question

On my project's configuration file I have:

session:
        handler_id:  session.handler.native_file
        save_path:   "%kernel.root_dir%/../var/sessions/%kernel.environment%"

"%kernel.root_dir%/../var/sessions belongs to wwww-data (and yes, php-fpm is running as www-data).

When the project runs, an (empty) session file is created in that dir, but apparently php/symfony have trouble actually reading/writing to it, despite being able to properly create it. Here's the empty session file, just created (no other process ran after this request):

The request dies raising an exception:

Session data file is not created by your uid.

I found this answer (and this one), and by doing that (setting my session's save_path to "/var/lib/php/sessions" I'm able to continue (and I can see that my session files get not only created, but that its contents are actually in place), but I'm trying to understand why it fails to save the session files on the custom location.

In my PHP configuration I see that I have session.save_path set to /var/lib/php/session, but I'd expect I'd be able to override that on execution time.

What really peeves me is that the session file get created (so file permissions should be fine), but not written into.

I'm running Symfony 3.2.2 on top of nginx + php-fpm (7.0).

Why is this happening? Is there any other setting I should use so php is able override this configuration and write its sessions files elsewhere?

From the trace I see that:

• NativeSessionStorage ->start() is called, and executes session_start (which returns true)
• Then SessionHandlerProxy ->read($sessionId) is called, and throws the exception when calling $this->handler->read($sessionId);.

Answer 1

If you want to use files to save sessions, best practice is to do it in a directory from the same owner as the web files, not in a "common" folder. This can means, for example, one directory up starting at web root:

• /home/myuser/sessions/
• /home/myuser/public_html/

This way, your sessions are secured (unaccessible from web), separate from sessions of other webs in the same server, and you are sure you can manage files in that directory.

Answer 2

Use standard folder, ie: /var/lib/php/session

Avoid using /tmp

Answer 3

I was able to reproduce the same exact error, creating the session file but throwing "Session data file is not created by your uid.", but I am not sure if this is your case.

Anyway, my guess is that you are using an nfs server to keep your code, but you develop and run nginx locally. You made a nfs mount to the server directory to sync your code to the server(we had the same in one of my previous employments).

So you mount the nfs server directory to a local directory. What happens is that php creates your session file with user www-data, but this user has a different uid on the server than your local machine. So file is created, you see the correct owner, but its uid is different.

Check:

link

link

This is just my best guess. If this is it, let me know, maybe I could help with nfs user mapping. Hope it helps.