Return value of SessionHandlerInterface methods in PHP - php

Question

I'm trying to understand PHP session handlers and more precisely the return value of SessionHandlerInterface::read.
The doc states (emphasis mine):
Returns an encoded string of the read data. If nothing was read, it must return false. Note this value is returned internally to PHP for processing.
However, the example used in the documentation of the SessionHandler class and other implementation (for instance Symfony's PdoSessionHandler) seem to return an empty string when nothing can be read (like for instance the very first time you connect to an host).
To illustrate this, I wrote a simple test (the class inherits from SessionHandler instead of implementing the whole SessionHandlerInterface for the sake of simplicity - I know this is not recommended and the example is useless: it's just here to show the problem):
<?php
define('RETURN_VALUE', false);
class SimpleSessionHandler extends SessionHandler
{
public function read($id)
{
$data = parent::read($id);
if (!$data) {
return RETURN_VALUE;
} else {
return data;
}
}
}
$handler = new SimpleSessionHandler();
session_set_save_handler($handler, true);
$res = session_start();
print_r($res);
echo("Done");
When using false as the return value, I get a PHP error (Warning: session_start(): Failed to read session data) while when I use '' (empty string) it works like a charm.
I'm missing something ?
I'm using PHP 7.4.20 under Fedora 33.

Answer 1

I asked the question on PHP mailing list (see the thread here).
From what I understood, read() should try to read the data if it exists or return an empty string if it doesn't; it should return false only when it can't read the data (for example if the session file cannot not be created or read, if the DB can't be reached, etc.).
In the case of a session handler based on some DB it would be something like this:
<?php
class DBSessionHandler implements SessionHandlerInterface
{
public function read($id)
{
try {
$data = $this->get_session_from_db();
if (len($data) > 0) {
// Return data
$this->serialize($data);
} else {
// Create new empty session here
try {
$this->create_empty_session_in_db();
} catch (Exception $e) {
return false;
}
return '';
}
} catch (Exception $e) {
return false;
}
}
}
I guess that most handlers would delay the insertion in write() though.