Repository navigation
[Server] Fix Session::save() wiping a session that the store failed to read - #637
Merged
chr-hertel merged 1 commit intoOct 28, 2026
Conversation
… to read It returns false instead of writing the changed keys alone over the session.
nicolas-grekas
requested review from
CodeWithKyrian,
Nyholm,
chr-hertel and
soyuka
as code owners
October 28, 2026 11:17
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues were identified for the change protecting stored session data when partial saves encounter failed reads.
No open issues 🎉
What changed in this PR
This PR prevents partial session updates from overwriting stored session data when a store read fails, while preserving saves for sessions that have never been stored.
Changes:
- Distinguishes failed reads from empty session data and returns
falsewhen a partial save cannot safely proceed. - Adds regression coverage for sessions that become unreadable and those that were never readable.
- Documents the fix in the changelog.
| File | Description |
|---|---|
| tests/Unit/Server/Session/SessionTest.php | Verifies failed reads prevent saves and preserve stored keys. |
| src/Server/Session/Session.php | Guards partial saves against unreadable stored sessions. |
| CHANGELOG.md | Documents the session data-loss fix. |
Review effort: Balanced
chr-hertel
approved these changes
Oct 28, 2026
chr-hertel
left a comment
Member
There was a problem hiding this comment.
Thank you @nicolas-grekas!
chr-hertel
added a commit
to BrocksiNet/php-sdk
that referenced
this pull request
Nov 4, 2026
…et/php-sdk into pr-618-end-a-listen-stream-that-can * 'fix/listen-empty-filter' of https://github.com/BrocksiNet/php-sdk: (25 commits) [Server] Pass an explicit null to a nullable tool parameter with a default (modelcontextprotocol#642) [Capability] Check tool names against the spec's 128-character limit and character set (modelcontextprotocol#639) [Tests] Stop php -S servers together with their forked workers (modelcontextprotocol#658) chore(deps): bump astral-sh/setup-uv from 10.3.2 to 10.3.3 (modelcontextprotocol#659) [Server] Accept plain http on `*.localhost` and `127.0.0.0/8` hosts in OAuth URLs (modelcontextprotocol#620) [Capability] Map PHPDoc pseudo-types to the JSON Schema type of their base type (modelcontextprotocol#643) Raise minimum versions of `phpdocumentor/reflection-docblock` and `psr/container` (modelcontextprotocol#657) [Server] Use compact JSON in result formatters (modelcontextprotocol#647) [Server] Filter list completions in one pass (modelcontextprotocol#649) [Server] Fix result lists being sent as JSON objects (modelcontextprotocol#656) Avoid repeated array merges in prompt formatting (modelcontextprotocol#650) [Docs] Add AGENTS.md (modelcontextprotocol#634) Avoid repeated array merges in resource formatting (modelcontextprotocol#651) [Server] Fix `"0"` prefix offering all completions (modelcontextprotocol#655) Filter enum completions in one pass (modelcontextprotocol#652) Paginate registry references before mapping (modelcontextprotocol#653) Extract JWT scopes in one pass (modelcontextprotocol#654) [Server] Fix `Session::save()` wiping a session that the store failed to read (modelcontextprotocol#637) [Server] Answer a DELETE of an unknown or ended session with 404 (modelcontextprotocol#638) [Server] Add `Psr6SessionStore` and `Psr6NotificationBus` (modelcontextprotocol#635) ...
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Session::save()writes the changed keys onto what the store holds by then. When the store fails to read the session,read()returnsfalse(Psr16SessionStoredoes that on any cache error), and the save wrote the changed keys alone over the session, wiping everything else:initialized, the client info, the protocol version...save()now returnsfalsein that case, as it already does for a session destroyed since it was read. A session that was never stored saves as before: telling it apart from an unreadable one costs oneexists()call on its first save.