diff --git a/lib/SimpleSAML/SessionHandlerPHP.php b/lib/SimpleSAML/SessionHandlerPHP.php index 0a646c58a16833c76bf90de03348861dfd92903a..d6e6d15e40d3e5ceb250ccc89d01f53c25cf7ea5 100644 --- a/lib/SimpleSAML/SessionHandlerPHP.php +++ b/lib/SimpleSAML/SessionHandlerPHP.php @@ -166,15 +166,16 @@ class SessionHandlerPHP extends SessionHandler public function newSessionId(): string { // generate new (secure) session id - if (function_exists('session_create_id')) { - $sid_length = (int) ini_get('session.sid_length'); - $sid_bits_per_char = (int) ini_get('session.sid_bits_per_character'); + $sid_length = (int) ini_get('session.sid_length'); + $sid_bits_per_char = (int) ini_get('session.sid_bits_per_character'); - if (($sid_length * $sid_bits_per_char) < 128) { - Logger::warning("Unsafe defaults used for sessionId generation!"); - } - $sessionId = session_create_id(); - } else { + if (($sid_length * $sid_bits_per_char) < 128) { + Logger::warning("Unsafe defaults used for sessionId generation!"); + } + $sessionId = session_create_id(); + + if (!$sessionId) { + Logger::warning("Secure session ID generation failed, falling back to custom ID generation."); $sessionId = bin2hex(openssl_random_pseudo_bytes(16)); } Session::createSession($sessionId);