Database exception using DbSession

[puku]

What steps will reproduce the problem?

When I'm trying to login on the website, from time to time I'm receiving an error message.
After reloading of the page everything is ok.
YII_DEBUG is enabled, YII_ENV_DEV is set to true.

Maybe this issue is linked with this one

Stackoverflow question

What do you get instead?

Integrity constraint violation – yii\db\IntegrityException

SQLSTATE[23000]: Integrity constraint violation: 1062 Duplicate entry '0' for key 'PRIMARY'
The SQL being executed was: UPDATE session SET id=0 WHERE id='3u5r7gq6pqh8s0gjrusfqpmni7'
Error Info: Array
(
[0] => 23000
[1] => 1062
[2] => Duplicate entry '0' for key 'PRIMARY'
)
↵
Caused by: PDOException

SQLSTATE[23000]: Integrity constraint violation: 1062 Duplicate entry '0' for key 'PRIMARY'

in /var/www/develop/vendor/yiisoft/yii2/db/Command.php at line 844

Additional info

Q	A
Yii version	2.0.10
PHP version	7.0
Operating system	Ubuntu 14.04

[bizley]

I think DbSession should check if $newID is properly set before trying to update DB with it.

[dynasource]

looks like it. If session_regenerate_id fails to generate an ID, its no use to update the DB with it.

[bizley]

Should the old session row be deleted in case the new ID can not be generated? For something like to prevent loosing the old data in race condition case?

I've tested DbSession simulating loosing ID and deleting session row in that case - everything looks ok.

[yanhuixie]

Same issue with Redis session implementation.
session_regenerate_id(): Session object destruction failed. ID: user (path: )
/vendor/yiisoft/yii2/web/Session.php L282
Yii2 2.0.10

[andrewnester]

@bizley I guess there is no need to delete session row. session_regenerate_id could fail, for instance, because of network issues and when will be ran second time it will return valid ID.

[andrewnester]

@yanhuixie it's a bit different, DbSession::regenerateID doesn't ask session_regenerate_id for session destruction

[bizley]

@andrewnester can you confirm that old row is deleted or updated later on? Because if not there is the risk of DB storage overfill.

[andrewnester]

@bizley thanks for reasonable question! In this case DbSession:: gcSession will handle all expired data