Ini_set(): Session ini settings cannot be changed when a session is active at /var/www/html/nextcloud/lib/base.php

Support intro

After the migration of my arm-based nextcloud installation (32 Bit) with php 7.4 to x86 (64 bit) with php 8.1 according to the official documentation the nextcloud log is flooded by “Session ini settings cannot be changed” error messages. All users can use Nextcloud without any problems on client side.

I started the migration with 25.0.13.2 on both sides and upgraded nextcloud on the x86 system in several steps up to 28.0.3 using the nextcloud web gui.

The line numbers beeing mentioned in the error messages are theses:

base.php
=========
[....]
        public static function initSession(): void {           
                $request = Server::get(IRequest::class);       
                                                               
                // TODO: Temporary disabled again to solve issues with CalDAV/CardDAV clients like DAVx5 that use cookies
                // TODO: See https://github.com/nextcloud/server/issues/37277#issuecomment-1476366147 and the other comments
                // TODO: for further information.              
                // $isDavRequest = strpos($request->getRequestUri(), '/remote.php/dav') === 0 || strpos($request->getRequestUri(), '/remote.php/webdav') === 0;
                // if ($request->getHeader('Authorization') !== '' && is_null($request->getCookie('cookie_test')) && $isDavRequest && !isset($_COOKIE['nc_session_id'])) {
                // setcookie('cookie_test', 'test', time() + 3600);
                // // Do not initialize the session if a request is authenticated directly
                // // unless there is a session cookie already sent along
                // return;
                // }

                if ($request->getServerProtocol() === 'https') {
                        ini_set('session.cookie_secure', 'true'); // < **line 431**
                }

                // prevents javascript from accessing php session cookies
                ini_set('session.cookie_httponly', 'true');

                // set the cookie path to the Nextcloud directory
                $cookie_path = OC::$WEBROOT ? : '/';
                ini_set('session.cookie_path', $cookie_path); // < **line 439**

                // Let the session name be changed in the initSession Hook
                $sessionName = OC_Util::getInstanceId();

[…]

Die Nextcloud instance is behind a nginx reverse proxy.

Nextcloud version (eg, 20.0.5): 28.0.3
Operating system and version (eg, Ubuntu 20.04): Alpine Linux 3.19
Apache or nginx version (eg, Apache 2.4.25): Apache 2.4.58-r1
PHP version (eg, 7.4): 8.1

The issue you are facing:
See Nextcloud log below. The issue is indepent from the client and most probably from the version of nextcloud (happend with 27.x, too)

Is this the first time you’ve seen this error? (Y/N): Y

Steps to replicate it:

  1. Install Nextcloud manually according to the official documentation (php packages beeing installed: php81 php81-apache2 php81-common php81-pdo_mysql php81-gd php81-pecl-imagick php81-curl php81-mbstring php81-intl php81-xml php81-zip php81-bcmath php81-gmp php81-session php81-dom php81-xmlreader php81-xmlwriter php81-simplexml php81-opcache php81-sysvsem php81-opcache php-pecl-memcache php81-exif php-pecl-apcu php81-pecl-apcu php81-sodium php81-pcntl)
  2. Migrate a working arm-based Installation (32 Bit) to this new x86 (64 Bit) installation according to the official documentation
  3. Use Nextcloud

The output of your Nextcloud log in Admin > Logging:

{"reqId":"97KXmjywmcFZM8i55dx1","level":3,"time":"2024-03-06T08:30:26+00:00","remoteAddr":"176.7.xxx.yyy","user":"--","app":"PHP",
"method":"PROPFIND","url":"/remote.php/dav/addressbooks/users/user1/default/","message":"ini_set(): Session ini settings cannot
be changed when a session is active at /var/www/html/nextcloud/lib/base.php#431","userAgent":"DAVx5/4.3.2-ose (2023/05/04; dav4jvm
; okhttp/4.10.0) Android/12","version":"28.0.3.2","data":{"app":"PHP"}}

{"reqId":"kAZy4EZxIt2XxegxcCrB","level":3,"time":"2024-03-06T08:39:54+00:00","remoteAddr":"80.152.xxx.yyy","user":"--","app":"PHP",
"method":"GET","url":"/index.php/apps/notes/api/v1/notes?pruneBefore=1709666306","message":"ini_set(): Session ini settings cannot
 be changed when a session is active at /var/www/html/nextcloud/lib/base.php#439","userAgent":"Mozilla/5.0 (Android) Nextcloud-and
roid/3.24.1","version":"28.0.3.2","data":{"app":"PHP"}}

{"reqId":"ZWJETUGEO7xFvaQoGitu","level":3,"time":"2024-03-06T10:28:37+00:00","remoteAddr":"192.168.xxx.yyy","user":"--","app":"PHP","method":"PUT","url":"/remote.php/dav/uploads/user3/31c807f44895c90b2a881a3cfa8d6426/000002","message":"ini_set(): Session ini settings cannot be changed when a session is active at /var/www/html/nextcloud/lib/base.php#439","userAgent":"Mozilla/5.0 (Android) Nextcloud-android/3.28.0","version":"28.0.3.2","data":{"app":"PHP"}

The output of your config.php file in /path/to/nextcloud (make sure you remove any identifiable information!):

<?php
$CONFIG = array (
  'instanceid' => 'foo',
  'passwordsalt' => 'bar',
  'secret' => 'foobar',
  'trusted_domains' => 
  array (
    0 => '192.168.xx.xx',
    1 => 'my.domain.example',
  ),
  'trusted_proxies' => 
  array (
    0 => '192.168.xx.xx',
  ),
  'forwarded_for_headers' => 
  array (
    0 => 'HTTP_X_REAL_IP',
  ),
  'overwrite.cli.url' => 'https://my.domain.example',
  'overwriteprotocol' => 'https',
  'overwritecondaddr' => '^192.168.xx.xx$',
  'datadirectory' => '/srv/nextcloud/data',
  'dbtype' => 'mysql',
  'version' => '28.0.3.2',
  'dbname' => 'dbname',
  'dbhost' => 'localhost',
  'dbport' => '',
  'dbtableprefix' => 'oc_',
  'mysql.utf8mb4' => true,
  'dbuser' => 'dbuser',
  'dbpassword' => 'A password',
  'installed' => true,
  'mail_smtpmode' => 'smtp',
  'mail_smtphost' => 'localhost',
  'mail_sendmailmode' => 'smtp',
  'mail_from_address' => 'nextcladmin',
  'mail_domain' => 'domain.example',
  'mail_smtpport' => '25',
  'memcache.local' => '\\OC\\Memcache\\APCu',
  'default_language' => 'de',
  'default_locale' => 'de_DE',
  'default_phone_region' => 'DE',
  'auth.bruteforce.protection.enabled' => true,
  'trashbin_retention_obligation' => 'auto,7',
  'share_folder' => '/Shared',
  'log_type' => 'file',
  'logfile' => '/srv/nextcloud/data/nextcloud.log',
  'logfilemode' => 416,
  'loglevel' => '2',
  'log_rotate_size' => 100 * 1024 * 1024,
  'maintenance' => false,
  'maintenance_window_start' => 4,
  'theme' => '',
  'session_lifetime' => 60 * 60 * 12,
  'updater.secret' => 'foo',
);
 

The output of your Apache/nginx/system log in /var/log/____:

no error messages

First two things that comes to mind

  • perhaps some your php session.* are non-default or somehow otherwise set to unexpected values. Namely session.auto_start (needs to be off)
  • What reverse proxy are you using? If NPM, turn off Asset caching.
1 Like

perhaps some your php session.* are non-default or somehow otherwise set to unexpected values.

I used nearly Alpines default. I changed only a few settings (apc.enable_cli=1, upload_max_filesize = 1024M and some opcache.-settings). I’ll recheck it.

Namely session.auto_start (needs to be off)

I tried already to switch this off (it on by default) in /etc/php81/php.ini. Didn’t change anything.

What reverse proxy are you using? If NPM, turn off Asset caching.

Nginx, no NPM.

Unfortunately, I just overwrote the php.ini file I had changed with the original file from the alpine linux package. :slightly_frowning_face:

In the original php.ini file I explicitly set “session.auto_start = 0” and set my opcache settings like before after this. Also I set “session.use_strict_mode = 1” and restarted Apache. The error messages are gone.

The reason for the problem was most probably a (changed) setting in the php.ini. Unfortunately I can no longer say which one.

Many thanks jtr.

1 Like

This topic was automatically closed 8 days after the last reply. New replies are no longer allowed.