{"action":"created","issue":{"url":"https://api.github.com/repos/symfony/symfony/issues/14761","labels_url":"https://api.github.com/repos/symfony/symfony/issues/14761/labels{/name}","comments_url":"https://api.github.com/repos/symfony/symfony/issues/14761/comments","events_url":"https://api.github.com/repos/symfony/symfony/issues/14761/events","html_url":"https://github.com/symfony/symfony/issues/14761","id":81326945,"number":14761,"title":"The session id is too long or contains illegal characters","user":{"login":"cmodijk","id":771041,"avatar_url":"https://avatars.githubusercontent.com/u/771041?v=3","gravatar_id":"","url":"https://api.github.com/users/cmodijk","html_url":"https://github.com/cmodijk","followers_url":"https://api.github.com/users/cmodijk/followers","following_url":"https://api.github.com/users/cmodijk/following{/other_user}","gists_url":"https://api.github.com/users/cmodijk/gists{/gist_id}","starred_url":"https://api.github.com/users/cmodijk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cmodijk/subscriptions","organizations_url":"https://api.github.com/users/cmodijk/orgs","repos_url":"https://api.github.com/users/cmodijk/repos","events_url":"https://api.github.com/users/cmodijk/events{/privacy}","received_events_url":"https://api.github.com/users/cmodijk/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/symfony/symfony/labels/HttpFoundation","name":"HttpFoundation","color":"DDDDDD"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-05-27T07:35:49Z","updated_at":"2015-09-04T18:31:19Z","closed_at":null,"body":"We are getting a lot of error's in our production environment with this error and we don't know how to solve this. I found some issue #1759 but the are talking about the test environment but we are not getting these in our test environment. The problem is also mentioned on [php.net](http://php.net/manual/en/function.session-start.php#82957) which checks the session id coming in. \r\n\r\n```\r\nWarning: SessionHandler::read(): The session id is too long or contains illegal characters, valid characters are a-z, A-Z, 0-9 and '-,' in ~/app/cache/prod/classes.php on line 409\r\n\r\nWarning: SessionHandler::write(): The session id is too long or contains illegal characters, valid characters are a-z, A-Z, 0-9 and '-,' in ~/app/cache/prod/classes.php on line 413\r\n```\r\n\r\nOur framework config has only these rules on sessions\r\n```\r\nframework:\r\n    session:\r\n        save_path:              \"%kernel.root_dir%/shared/%kernel.environment%/sessions\"\r\n```\r\n\r\nWe are using \r\n* Symfony: 2.6.7\r\n* PHP: 5.5.23\r\n\r\nOther links\r\n* http://stackoverflow.com/questions/3185779/the-session-id-is-too-long-or-contains-illegal-characters-valid-characters-are\r\n* http://php.net/manual/en/function.session-start.php#82957"},"comment":{"url":"https://api.github.com/repos/symfony/symfony/issues/comments/137813575","html_url":"https://github.com/symfony/symfony/issues/14761#issuecomment-137813575","issue_url":"https://api.github.com/repos/symfony/symfony/issues/14761","id":137813575,"user":{"login":"Tobion","id":610090,"avatar_url":"https://avatars.githubusercontent.com/u/610090?v=3","gravatar_id":"","url":"https://api.github.com/users/Tobion","html_url":"https://github.com/Tobion","followers_url":"https://api.github.com/users/Tobion/followers","following_url":"https://api.github.com/users/Tobion/following{/other_user}","gists_url":"https://api.github.com/users/Tobion/gists{/gist_id}","starred_url":"https://api.github.com/users/Tobion/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Tobion/subscriptions","organizations_url":"https://api.github.com/users/Tobion/orgs","repos_url":"https://api.github.com/users/Tobion/repos","events_url":"https://api.github.com/users/Tobion/events{/privacy}","received_events_url":"https://api.github.com/users/Tobion/received_events","type":"User","site_admin":false},"created_at":"2015-09-04T18:31:19Z","updated_at":"2015-09-04T18:31:19Z","body":"This should only happen if a user purposely changes the session id (in order to exploit it). I think the newer php version added this validation which result in the error you get. What different behavior would you expect? "}}