in PHP how to check if specific session id exists?

Question

How can i check if session id 066efd5a182729d6fdbd43cb3a80adde exists or not? (I know it existed at some point in the past, but I need to know if it still does or not)

session_exists("066efd5a182729d6fdbd43cb3a80adde")
? "this session exists" : "this session expired/got deleted/whatever";

PS This is not a duplicate of:

• Check if session exists in php because that guy wanted to see if the current request contained a valid cookie session or not (his problem can be solved with session_status() == PHP_SESSION_NONE, mine cannot)
• PHP if SESSION exists but is null - i don't even understand what he means by How I can check in PHP if SESSION exists but is null. , i certainly don't want to check if $_SESSION is null.

Answer 1

How can i check if session id 066efd5a182729d6fdbd43cb3a80adde exists or not? (I know it existed at some point in the past, but I need to know if it still does or not)

As with any other session ID as well.

Ensure you have no session opened, then set the session_id($id) and start the session session_start(). You find $_SESSION populated if there is some data associated with that (new) session id.

Now, PHP has an option to change the session id on start if it does not exists (Cf. _session.use_strict_mode; use_strict_mode in php sessions). So comparing after start if the ID is unchanged will tell you if the session exists.

Then decide what you want to do with the previously (non-) existing session, like kill it with fire, unset the cookie etc. (depends on context.)

Given, you only want to check the session id:

assert(PHP_SESSION_NONE === session_status());
assert(empty(session_id()));

echo session_exists("066efd5a182729d6fdbd43cb3a80adde")
    ? "this session exists" : "this session has expired";

assert(PHP_SESSION_NONE === session_status());
assert(empty(session_id()));

without affecting HTTP response headers, including not setting session cookie headers, here an example function:

function session_exists(string $session_id): bool {
    session_id($session_id);
    session_start(['cache_limiter' => '', 'use_cookies' => false, 'use_strict_mode' => true,]);
    $exists = $session_id === session_id();
    $exists ? session_abort() && session_id('') : session_destroy();
    return $exists;
}

Take care, it is with no error handling, e.g. session_start() may return false which means there was a failure.

Answer 2

as long as you're using the php-redis session module, or the default php-built-in files session module:

function session_exists(string $session_id, ?array $stuff = null): bool
{
    // https://php.net/session_module_name
    // ini: https://php.net/session.save_handler
    $session_module_name = session_module_name();

    if ($session_module_name === 'files') {
        // https://php.net/session_save_path
        // ini: https://php.net/session.save_path
        $session_file = session_save_path() . '/sess_' . $session_id;
        clearstatcache(false, $session_file);
        return file_exists($session_file);
    }

    if ($session_module_name === 'redis') {
        $redis = $stuff['redis_connection'] ?? null;
        if ($redis === null) {
            $redis = new Redis();
            $host = session_save_path(); // tcp://redis:6379
            $port_needle = strrpos($host, ':');
            $port = substr($host, $port_needle + 1);
            $port = filter_var($port, FILTER_VALIDATE_INT);
            if ($port === false) {
                throw new Exception("Unable to parse port from session_save_path(): " . session_save_path());
            }
            $host = substr($host, 0, $port_needle);
            $redis->connect($host, $port);
        }
        return $redis->exists("PHPREDIS_SESSION:{$session_id}") > 0;
    }

    throw new BadFunctionCallException(__FUNCTION__ . ": Unknown/unsupported session module name: {$session_module_name}");
}

usage:

echo session_exists("066efd5a182729d6fdbd43cb3a80adde")
 ? "this session exists" : "this session has expired";