Ability to session_decode() in a stateless manner?

> > Hi! > > Earlier today I was working on a small tool to invalidate PHP Sessions in a > legacy system. I quickly found out about the `session_decode()` function, > but unfortunately this function requires an active session and it is > completely stateful, which means when I try to decode a specific session > data, I end up overriding the existing session. > > I also tried combining `ob_start()` with `session_id()`, `session_start()`, > `session_destroy()` and `ob_end_clean()`, but this would still cause some > weird behaviors by sending two PHP Cookies through the Response Headers. > > In an ideal world, I would override `session.serialize_handler` and be done > with it, but that would require invalidating every existing session and > some non-trivial changes in the 20 year old codebase. > > To my original question, is there any exposed API that would give userland > access to the session deserializer algorithm in a stateless manner? > Something like `session_deserialize(string $data): array;`, preferably in a > way that > 1) doesn't require or doesn't conflict with any existing session and > 2) returns the session array without any side effects? > > If not, would this be something that requires an RFC? Are there any > controversial thoughts around it? > > Thanks! > > -- > Marco Deleu