PHP error guide

session_start called while a session is active: meaning and fix

notice warning Affects: PHP 7.4–8.4 Last verified:

Error summary

Centralize session startup or guard optional initialization with session_status instead of suppressing duplicate calls.

What it means

Centralize session startup or guard optional initialization with session_status instead of suppressing duplicate calls.

What the error means

The process already has an active session, so PHP ignores the second session_start call.

Why PHP produces it

Multiple bootstrap files, middleware layers, or plugins each assume they own session initialization.

PHP version notes

The behavior described for session_start called while a session is active applies to PHP 7.4–8.4 unless a narrower version is stated; exact wording can vary by SAPI and patch release.

Most common causes

  • A shared include and controller both call session_start.
  • Framework middleware starts the session before legacy code.
  • A plugin starts sessions on every hook.

Minimal examples

BAD — reproduces the problem

php 
@session_start();

FIXED — safer pattern

php 
if (session_status() === PHP_SESSION_NONE) { session_start(); }

Step-by-step diagnosis

  1. Log a backtrace around session_start call sites in development.
  2. Check session_status at each initialization boundary.
  3. Search bootstrap, middleware, and plugin code for duplicate starts.

Fixes

Use one owner or an explicit guard

Start once in early middleware; guard only compatibility code that can run in either context.

php 
if (session_status() === PHP_SESSION_NONE) {
    session_start();
}

Common mistakes when fixing it

  • Suppressing the notice with @.
  • Calling session_write_close and assuming data remains writable.
  • Starting sessions in reusable library constructors.

How to prevent it

  • Assign session lifecycle to one middleware.
  • Keep libraries independent of implicit global sessions.
  • Test requests with and without an existing session cookie.

Web server / environment notes

fpm, apache, cli. Session state is process-request scoped, including CLI when explicitly used.

Tags: fpm,apache,cli

Categories