Session data not written to disk (0-byte session files) with FrankenPHP 1.11.2 + Symfony 8.0.5 in worker mode

[ArnaudV]

After upgrading from FrankenPHP 1.11.1 to 1.11.2, native file-based sessions stopped working in worker mode with Symfony 8.0.5. Session files are created on disk
but remain 0 bytes — the session data is never written. This causes users to be logged out on every page load.

Rolling back to FrankenPHP 1.11.1 immediately fixes the issue.

Environment

• FrankenPHP 1.11.2 (Docker image dunglas/frankenphp:1.11-php8.5)
• PHP 8.5.2
• Symfony 8.0.5 (symfony/http-kernel v8.0.5, symfony/http-foundation v8.0.5)
• Worker mode with 8 workers, MAX_REQUESTS=100
• Native file session handler (session.save_handler = files)
• Linux (Debian-based Docker container)

Steps to reproduce

1. Use FrankenPHP 1.11.2 in worker mode with Symfony 8.0.5
2. Configure native file sessions (handler_id: null, save_path: '%kernel.project_dir%/var/sessions/%kernel.environment%')
3. Log in or trigger any action that writes to the session
4. Observe that session files in var/sessions/prod/ are created but remain 0 bytes
5. The user is not authenticated on the next request

Problem behavior

Session files are created (proving session_start() is called) but remain 0 bytes (session data is never persisted). Users are logged out on every page
navigation.

Investigation

• Raw PHP sessions work fine: calling session_start() + $_SESSION['test'] = 'value' + session_write_close() directly writes data to disk correctly
• The issue is specific to Symfony's session lifecycle within the FrankenPHP worker loop
• All Symfony code, configuration, and compiled container config is identical between the working (1.11.1) and broken (1.11.2) images — only the FrankenPHP
  version differs
• Pinning back to dunglas/frankenphp:1.11.1-php8.5 immediately resolves the issue

Suspected cause

PR #2139 (merged in 1.11.2) resets $_SESSION and INI settings between worker requests at the C level. Symfony 8.0.4 (PR symfony/symfony#62848) also changed the
timing of service resets in Kernel::boot(), including AbstractSessionListener::reset() which calls session_abort(), session_unset(), and session_id('').

The interaction between these two reset mechanisms may cause session data to be discarded before Symfony's session_write_close() flushes it to disk.
Specifically, if FrankenPHP's $_SESSION snapshot/restore interferes with the PHP session module's internal reference to $_SESSION, the data written by
session_write_close() could be empty even though the application populated $_SESSION during the request.

Build Type

Docker (Debian Trixie)

Worker Mode

Yes

Operating System

GNU/Linux

CPU Architecture

x86_64

PHP configuration

phpinfo()
PHP Version => 8.5.2

System => Linux x86_64
Build Date => Feb  3 2026 02:28:01
Build System => Linux - Docker
Build Provider => https://github.com/docker-library/php
Configure Command =>  './configure'  '--build=x86_64-linux-gnu' '--sysconfdir=/usr/local/etc' '--with-config-file-path=/usr/local/etc/php' '--with-config-file-scan-dir=/usr/local/etc/php/conf.d' '--enable-option-checking=fatal' '--with-mhash' '--with-pic' '--enable-mbstring' '--enable-mysqlnd' '--with-password-argon2' '--with-sodium=shared' '--with-pdo-sqlite=/usr' '--with-sqlite3=/usr' '--with-curl' '--with-iconv' '--with-openssl' '--with-readline' '--with-zlib' '--enable-phpdbg' '--enable-phpdbg-readline' '--with-pear' '--with-libdir=lib/x86_64-linux-gnu' '--enable-embed' '--enable-zts' '--disable-zend-signals' 'build_alias=x86_64-linux-gnu' 'PHP_UNAME=Linux - Docker' 'PHP_BUILD_PROVIDER=https://github.com/docker-library/php'
Server API => Command Line Interface
Virtual Directory Support => enabled
Configuration File (php.ini) Path => /usr/local/etc/php
Loaded Configuration File => /usr/local/etc/php/php.ini
Scan this dir for additional .ini files => /usr/local/etc/php/conf.d
Additional .ini files parsed => /usr/local/etc/php/conf.d/app.prod.ini,
/usr/local/etc/php/conf.d/docker-php-ext-apcu.ini,
/usr/local/etc/php/conf.d/docker-php-ext-calendar.ini,
/usr/local/etc/php/conf.d/docker-php-ext-exif.ini,
/usr/local/etc/php/conf.d/docker-php-ext-gd.ini,
/usr/local/etc/php/conf.d/docker-php-ext-imagick.ini,
/usr/local/etc/php/conf.d/docker-php-ext-intl.ini,
/usr/local/etc/php/conf.d/docker-php-ext-pdo_mysql.ini,
/usr/local/etc/php/conf.d/docker-php-ext-redis.ini,
/usr/local/etc/php/conf.d/docker-php-ext-sodium.ini,
/usr/local/etc/php/conf.d/docker-php-ext-xsl.ini,
/usr/local/etc/php/conf.d/docker-php-ext-zip.ini

PHP API => 20250925
PHP Extension => 20250925
Zend Extension => 420250925
Zend Extension Build => API420250925,TS
PHP Extension Build => API20250925,TS
PHP Integer Size => 64 bits
Debug Build => no
Thread Safety => enabled
Thread API => POSIX Threads
Zend Signal Handling => disabled
Zend Memory Manager => enabled
Zend Multibyte Support => provided by mbstring
Zend Max Execution Timers => enabled
IPv6 Support => enabled
DTrace Support => disabled

Registered PHP Streams => https, ftps, compress.zlib, php, file, glob, data, http, ftp, phar, zip
Registered Stream Socket Transports => tcp, udp, unix, udg, ssl, tls, tlsv1.0, tlsv1.1, tlsv1.2, tlsv1.3
Registered Stream Filters => zlib.*, convert.iconv.*, string.rot13, string.toupper, string.tolower, convert.*, consumed, dechunk

This program makes use of the Zend Scripting Language Engine:
Zend Engine v4.5.2, Copyright (c) Zend Technologies
    with Zend OPcache v8.5.2, Copyright (c), by Zend Technologies


 _______________________________________________________________________


Configuration

apcu

APCu Support => Enabled
Version => 5.1.28
APCu Debugging => Disabled
MMAP Support => Enabled
MMAP File Mask =>
Serialization Support => php

Directive => Local Value => Master Value
apc.coredump_unmap => Off => Off
apc.enable_cli => On => On
apc.enabled => On => On
apc.entries_hint => 0 => 0
apc.gc_ttl => 3600 => 3600
apc.mmap_file_mask => no value => no value
apc.mmap_hugepage_size => 0 => 0
apc.preload_path => no value => no value
apc.serializer => php => php
apc.shm_size => 512M => 512M
apc.slam_defense => Off => Off
apc.smart => 0 => 0
apc.ttl => 0 => 0
apc.use_request_time => Off => Off

calendar

Calendar support => enabled

Core

PHP Version => 8.5.2

Directive => Local Value => Master Value
allow_url_fopen => On => On
allow_url_include => Off => Off
auto_globals_jit => On => On
default_charset => UTF-8 => UTF-8
display_errors => Off => Off
display_startup_errors => Off => Off
enable_dl => Off => Off
error_log => /dev/stderr => /dev/stderr
error_reporting => 22527 => 22527
expose_php => Off => Off
fatal_error_backtraces => On => On
file_uploads => On => On
hard_timeout => 2 => 2
html_errors => Off => Off
implicit_flush => On => On
log_errors => On => On
max_execution_time => 0 => 0
max_file_uploads => 20 => 20
max_input_nesting_level => 128 => 128
max_input_time => -1 => -1
max_input_vars => 5000 => 5000
max_memory_limit => -1 => -1
memory_limit => 512M => 512M
output_buffering => 0 => 0
post_max_size => 20M => 20M
realpath_cache_size => 4096K => 4096K
realpath_cache_ttl => 600 => 600
register_argc_argv => Off => Off
request_order => GP => GP
short_open_tag => Off => Off
upload_max_filesize => 20M => 20M
variables_order => GPCS => GPCS
zend.assertions => -1 => -1
zend.enable_gc => On => On
zend.exception_ignore_args => On => On
zend.exception_string_param_max_len => 0 => 0

ctype

ctype functions => enabled

curl

cURL support => enabled
cURL Information => 8.14.1

date

date/time support => enabled
timelib version => 2022.14
"Olson" Timezone Database Version => 2025.2
Timezone Database => internal
Default timezone => Europe/Paris

dom

DOM/XML => enabled
DOM/XML API Version => 20031129
libxml Version => 2.9.14

exif

EXIF Support => enabled
Supported EXIF Version => 0220

fileinfo

fileinfo support => enabled
libmagic => 5.46

filter

Input Validation and Filtering => enabled

gd

GD Support => enabled
GD Version => bundled (2.1.0 compatible)
FreeType Support => enabled
FreeType Version => 2.13.3
JPEG Support => enabled
PNG Support => enabled
libPNG Version => 1.6.48
WebP Support => enabled
AVIF Support => enabled

hash

hash support => enabled

iconv

iconv support => enabled
iconv implementation => glibc
iconv library version => 2.41

imagick

imagick module => enabled
imagick module version => 3.8.1
Imagick compiled with ImageMagick version => ImageMagick 7.1.1-43 Q16 x86_64

intl

Internationalization support => enabled
ICU version => 76.1
ICU Data version => 76.1

json

json support => enabled

lexbor

Lexbor support => active
Lexbor version => 2.5.0

libxml

libXML support => active
libXML Compiled Version => 2.9.14

mbstring

Multibyte Support => enabled
Multibyte string engine => libmbfl
libmbfl version => 1.3.2
Multibyte (japanese) regex support => enabled
Multibyte regex (oniguruma) version => 6.9.9

mysqlnd

mysqlnd => enabled
Version => mysqlnd 8.5.2

openssl

OpenSSL support => enabled
OpenSSL Library Version => OpenSSL 3.5.4 30 Sep 2025

pcre

PCRE (Perl Compatible Regular Expressions) Support => enabled
PCRE Library Version => 10.44 2024-06-07
PCRE JIT Support => enabled

PDO

PDO support => enabled
PDO drivers => sqlite, mysql

pdo_mysql

PDO Driver for MySQL => enabled
Client API version => mysqlnd 8.5.2

pdo_sqlite

PDO Driver for SQLite 3.x => enabled
SQLite Library => 3.46.1

Phar

Phar: PHP Archive support => enabled

posix

POSIX support => enabled

random

Version => 8.5.2

readline

Readline Support => enabled
Readline library => 8.2

redis

Redis Support => enabled
Redis Version => 6.3.0
Redis Sentinel Version => 1.0
Available serializers => php, json
Available compression => lzf, zstd, lz4

session

Session Support => enabled
Registered save handlers => files user redis rediscluster
Registered serializer handlers => php_serialize php php_binary

Directive => Local Value => Master Value
session.auto_start => Off => Off
session.cache_expire => 180 => 180
session.cache_limiter => nocache => nocache
session.cookie_domain => no value => no value
session.cookie_httponly => On => On
session.cookie_lifetime => 0 => 0
session.cookie_partitioned => Off => Off
session.cookie_path => / => /
session.cookie_samesite => no value => no value
session.cookie_secure => On => On
session.gc_divisor => 1000 => 1000
session.gc_maxlifetime => 1440 => 1440
session.gc_probability => 1 => 1
session.lazy_write => On => On
session.name => PHPSESSID => PHPSESSID
session.save_handler => files => files
session.save_path => no value => no value
session.serialize_handler => php => php
session.sid_bits_per_character => 4 => 4
session.sid_length => 32 => 32
session.upload_progress.cleanup => On => On
session.upload_progress.enabled => On => On
session.use_cookies => On => On
session.use_only_cookies => On => On
session.use_strict_mode => On => On
session.use_trans_sid => Off => Off

SimpleXML

SimpleXML support => enabled

sodium

sodium support => enabled
libsodium headers version => 1.0.18
libsodium library version => 1.0.18

SPL

SPL support => enabled

sqlite3

SQLite3 support => enabled
SQLite Library => 3.46.1

tokenizer

Tokenizer Support => enabled

uri

URI support => active
uriparser bundled version => 1.0.0

xml

XML Support => active
libxml2 Version => 2.9.14

xmlreader

XMLReader => enabled

xmlwriter

XMLWriter => enabled

xsl

XSL => enabled
libxslt Version => 1.1.35

Zend OPcache

Opcode Caching => Up and Running
Optimization => Enabled
SHM Cache => Enabled
File Cache => Disabled
JIT => Disabled
Startup => OK
Shared memory model => mmap

Directive => Local Value => Master Value
opcache.enable => On => On
opcache.enable_cli => On => On
opcache.enable_file_override => On => On
opcache.interned_strings_buffer => 16 => 16
opcache.jit => disable => disable
opcache.jit_buffer_size => 64M => 64M
opcache.max_accelerated_files => 20000 => 20000
opcache.memory_consumption => 256 => 256
opcache.preload => /app/config/preload.php => /app/config/preload.php
opcache.preload_user => www-data => www-data
opcache.revalidate_freq => 0 => 0
opcache.validate_timestamps => Off => Off

zip

Zip => enabled
Zip version => 1.22.7
Libzip version => 1.11.3

zlib

ZLib Support => enabled
Compiled Version => 1.3.1
Linked Version => 1.3.1

Relevant log output

[xavierleune]

Hi @ArnaudV, thanks for the detailed issue. If you're able to reproduce it in dev environment, may you please try to build this version of frankenphp: #2193 ? You seemed to have a good understanding of the underlying issue, may you create a simple reproducer for the bug when using symfony ?
Thanks for your help !

[ArnaudV]

Hi @xavierleune

Test procedure

1. Built FrankenPHP from alketech/fix/session branch using docker buildx bake (runner target, PHP 8.5, trixie)
2. Built production app image on top of it
3. Deployed to production server via Kamal
4. Tested with 8 workers, then with 1 worker
5. Inspected session files on disk

Results — Issue NOT fixed

With 8 workers: 7 zero-byte session files vs 3 non-zero created after deploy (~70% corrupted). Login works for a few page loads then
disconnects.

With 1 worker: Still produces 0-byte session files. Same disconnect behavior. This rules out a multi-worker race condition.

Key observation

Pages that only read the session (e.g. Admin panel) keep the session alive — I can navigate many pages without being
disconnected. Pages that write to the session (e.g. $this->requestStack->getSession()->set('xxx', $yyy)) cause immediate disconnect on the next page
load, with the session file becoming 0 bytes.

This suggests the bug is specifically in session write/save in worker mode: when session_write_close() (or equivalent) is called
after session data has been modified, the file is truncated to 0 bytes instead of being written with the updated data.

Session file listing (post-deploy sample)
-rw------- 1 root root 0 Feb 17 01:50 sess_8dad01a6...
-rw------- 1 root root 164 Feb 17 01:49 sess_3381cf08...
-rw------- 1 root root 0 Feb 17 01:49 sess_4b3289ed...
-rw------- 1 root root 0 Feb 17 01:49 sess_99f1c8b3...
-rw------- 1 root root 334 Feb 17 01:46 sess_5342731c...
-rw------- 1 root root 873 Feb 17 01:43 sess_28f255b4...

Rollback

Reverted to dunglas/frankenphp:1.11.1-php8.5 which does not exhibit this issue.

[henderkes]

@ArnaudV thank you so much for the investigation. Could you also try fix/session-handlers branch from this (php/frankenphp) repository?

[ArnaudV]

@henderkes Thanks! I did more testing before seeing your message and found a more precise pattern:

Refined finding: GET + session write + 200 = corruption / POST + session write + 302 = OK

Works (session persists):

• Any page that only reads the session (no $session->set()) → stays logged in across many page loads
• Any POST request that writes to the session (e.g. flash messages via $session->getFlashBag()->add(...)) followed by a 302 redirect
  → stays logged in, flash message displays correctly

Breaks (session file becomes 0 bytes):

• Any GET request that calls $session->set('key', $value) and returns a 200 response with a rendered template → disconnected on next page load

The pattern: session_write_close() appears to work correctly when the response is a 302 redirect, but truncates the session file to 0 bytes when the response is a 200 with a rendered body.

I will test fix/session-handlers tomorrow.

[ArnaudV]

Test results for fix/session-handlers (PR #2192)

Environment: Symfony 8.0.5, 8 workers, MAX_REQUESTS=100, file-based sessions, deployed behind Cloudflare via Kamal.

Build & deploy

Built from php/frankenphp fix/session-handlers branch, pushed to ghcr.io, deployed to production.

Simple test pages: OK

Created a dedicated SessionTestController with isolated routes:

/session-test/write │ GET + $session->set() + 200 -> Session persists
/session-test/form │ POST + flash + 302 -> Session persists
/session-test/heavy │ GET + DB query + 100KB response + 200 -> Session persists
/session-test/twig │ GET + Twig render() + 200 -> Session persists
/session-test/subrequest │ GET + 4x render(controller()) + 200 -> Session persists

Real application heavy pages: Still disconnects

However, visiting real analytics pages still causes immediate session loss. Pages load
normally (no timeout, no error), but the user is logged out on the next navigation.

The key difference between test pages and real pages:

• Real pages include a session.js that fires $.ajax('/session') on page load (reads session + consumes flash messages)
• Real pages include HTMX fragments with hx-trigger="load" that fire additional concurrent requests
• These concurrent AJAX requests hit the server while the main page is still rendering, meaning multiple workers access the same session file simultaneously?