PHP 8.6 will warn developers when a custom session handler is missing create_sid() or validateId(). Both methods are set to become part of SessionHandlerInterface in PHP 9.0.

Gina Peter Banyard proposed the change in the PHP 8.6 deprecations RFC. The vote passed with 44 votes in favor and none against. Banyard then added the change to php-src on August 15.

The goal is to make custom session handlers work correctly with PHP's strict session mode. The two methods control how a new session ID is created and how an existing ID is checked.

Two Checks in PHP 8.6

PHP 8.6 performs these checks in two places.

First, session_set_save_handler() emits an E_DEPRECATED message for each missing method:

Providing an object to argument #1 ($sessionhandler) which does not have
the create_sid() method defined is deprecated

Providing an object to argument #1 ($sessionhandler) which does not have
the validateId() method defined is deprecated

These messages appear only when the application calls session_set_save_handler() with an incomplete object.

PHP also checks classes that implement SessionHandlerInterface. When one of those classes is loaded without either method, PHP raises an E_WARNING:

Class ExampleSessionHandler implementing SessionHandlerInterface is missing
the create_sid() method which will be required in PHP 9.0

The same warning is raised for a missing validateId() method.

This second check does not depend on session_set_save_handler(). Loading the class is enough to trigger it. It is also an E_WARNING, so hiding deprecation notices will not hide this message.

Laravel and Symfony Are Affected

The current Laravel 13 session handlers implement SessionHandlerInterface without either method. This includes its file, database, cookie, cache, array, and null handlers.

Each loaded handler can therefore raise two warnings on PHP 8.6. Laravel does not register these classes through PHP's native session_set_save_handler() function, so it avoids the separate deprecation messages from that call.

Symfony's current session handlers are closer to the new requirement. Classes based on AbstractSessionHandler already provide validateId() through SessionUpdateTimestampHandlerInterface, but they do not provide create_sid(). They can raise one warning instead of two.

These results come from comparing the current framework source with the PHP 8.6 implementation. Framework updates may add the missing methods before developers move their applications to PHP 8.6.

SessionHandler Gains validateId()

PHP's built-in SessionHandler class already has create_sid(). The same change adds a working validateId() method to that class.

This means a custom handler that extends SessionHandler can inherit both methods. That option only makes sense when the built-in handler's behavior fits the application's storage setup.

Developers who implement SessionHandlerInterface directly should add both methods themselves. The method that checks an ID needs to use the same storage rules as the rest of the custom handler.

The implementation also updates tests for php-src issue #9583. That issue covers session_create_id() failing when a user session handler does not provide validateId().

What Maintainers Should Do

Package and framework maintainers should search for classes that implement SessionHandlerInterface. Each class will need both of these methods before PHP 9:

public function create_sid(): string;

public function validateId(string $id): bool;

Projects can add them before requiring PHP 8.6, which lets maintainers release compatibility updates early.

See the implementation commit for the exact checks. You can also read the results from the wider PHP 8.6 deprecation vote.