Why does Symfony2 replace PHPSESSID upon login? Why does Symfony2 replace PHPSESSID upon login? symfony symfony

Why does Symfony2 replace PHPSESSID upon login?


It is to prevent session fixation. I would advise another cookie then the session one for loadbalancing.


This can be a bug. For symfony2.0 if you try to read something from session or even try to get a session identifier when SessionListener was not invoked yet you will notice that the new session is started with another PHPSESSID.

This also can be related to locale support, here is my issue for this: https://github.com/symfony/symfony/issues/3662