From 8cf58181156a773cbf9f5c293e4c066c5f8336d4 Mon Sep 17 00:00:00 2001
From: banghamid <62824084+banghamid@users.noreply.github.com>
Date: Wed, 11 Nov 2026 16:40:06 +0700
Subject: [PATCH] fix(Session): sync Request cookie global when unsetting
 invalid session cookie

---
 system/Session/Session.php           |  9 ++++++---
 tests/system/Session/SessionTest.php | 13 +++++++++++++
 2 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/system/Session/Session.php b/system/Session/Session.php
index 1cb47c2ee260..455097bc6686 100644
--- a/system/Session/Session.php
+++ b/system/Session/Session.php
@@ -108,16 +108,19 @@ public function start()
         $this->setSaveHandler();
 
         // Sanitize the cookie, because apparently PHP doesn't do that for userspace handlers
-        $cookie = service('superglobals')->cookie($this->config->cookieName);
+        $superglobals = service('superglobals');
+        $cookie       = $superglobals->cookie($this->config->cookieName);
 
         if (isset($cookie) && (! is_string($cookie) || preg_match('#\A' . $this->sidRegexp . '\z#', $cookie) !== 1)) {
-            service('superglobals')->unsetCookie($this->config->cookieName);
+            $superglobals->unsetCookie($this->config->cookieName);
+            service('request')->setGlobal('cookie', $superglobals->getCookieArray());
+            $cookie = null;
         }
 
         $this->startSession();
 
         // Is session ID auto-regeneration configured? (ignoring ajax requests)
-        $requestedWith = service('superglobals')->server('HTTP_X_REQUESTED_WITH');
+        $requestedWith = $superglobals->server('HTTP_X_REQUESTED_WITH');
         if (($requestedWith === null || strtolower($requestedWith) !== 'xmlhttprequest')
             && ($regenerateTime = $this->config->timeToUpdate) > 0
         ) {
diff --git a/tests/system/Session/SessionTest.php b/tests/system/Session/SessionTest.php
index 91ed72173097..b0c290b1cb27 100644
--- a/tests/system/Session/SessionTest.php
+++ b/tests/system/Session/SessionTest.php
@@ -694,4 +694,17 @@ public function testExpiresOnClose(): void
         $this->assertCount(1, $cookies);
         $this->assertSame(0, $cookies[0]->getExpiresTimestamp());
     }
+
+    public function testStartUnsetsInvalidSessionCookieInSuperglobalsAndRequest(): void
+    {
+        service('superglobals')->setCookie('ci_session', 'invalid-session-id!');
+
+        $this->assertSame('invalid-session-id!', service('request')->getCookie('ci_session'));
+
+        $session = $this->getInstance();
+        $session->start();
+
+        $this->assertNull(service('superglobals')->cookie('ci_session'));
+        $this->assertNull(service('request')->getCookie('ci_session'));
+    }
 }