Body: <p>I have a strange situation where anonymous session data is getting removed when that user creates a Drupal account. Specifically this is happening when a user has commerce cart data in the session, and after account creation, is taken to the next step in the commerce checkout flow, and is denied access because the cart data is removed. I was tempted to think that the data is replaced by the Civi data, now in the session; in fact the session is a completely new one for the user, with a new sid etc. I'm pretty stumped in how to debug this further, so I'm wondering if others have seen anything similar.</p>
  <p>Here's what I've found. In the <code>initialize()</code> method of the Civi core Session class there is the following check:</p>
  <pre><code>    if (($sid = session_id()) !== $this-&gt;sessionID) {
        $this-&gt;_session = NULL;
        $this-&gt;sessionID = $sid;
      }
  </code></pre>
  <p>I'm not completely clear about the utility of this check, but in my case, this is where existing session data is getting set to NULL. I've commented this out and my application appears to be working correctly, with the $_SESSION variable now storing the commerce cart data as well as the civi data after user login. I would still like to know why this check is there, the only comments are inline above it:</p>
  <pre><code>// remove $_SESSION reference if session is changed
  </code></pre>
  <p>That's a little mysterious, but that's what we have in any case.</p>
  <p>Link to lab ticket: <a href="https://lab.civicrm.org/dev/drupal/-/issues/163" rel="nofollow noreferrer">https://lab.civicrm.org/dev/drupal/-/issues/163</a></p>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-08-30T21:12:57.630Z
Comments.Text: Can you disable CiviCRM (with cautions noted) and see if that affects it. if not then this sounds like purely a Drupal question and may be better in the Drupal channel
Comments.UserDisplayName: petednz - fuzion
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-08-31T14:23:31.617Z
Comments.Text: Which version of Drupal are you using?  Is the user account creation directly in Drupal or via CiviCRM?
Comments.UserDisplayName: Aidan
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-08-31T16:47:14.420Z
Comments.Text: I should have been more clear, the $_SESSION is getting replaced in vendor/civicrm/civicrm-core/CRM/Core/Session.php. I've been debugging line 270 which is `$this->createScope($prefix, TRUE);`, but it's called so many times during login that I haven't been able to pinpoint the condition that is causing `createScope()` to get rid of the current session.
Comments.UserDisplayName: Steve Platz
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-08-31T17:06:17.833Z
Comments.Text: Sorry, the app is using Drupal 9.2.2.
Comments.UserDisplayName: Steve Platz
Tags: <drupal><session><commerce>
Title: What would cause CiviCRM to clobber anonymous session data on Drupal user account creation?
ThreadText: # What would cause CiviCRM to clobber anonymous session data on Drupal user account creation?
  
  (Asked by: username_0 on 2021-08-30)
  
  I have a strange situation where anonymous session data is getting removed when that user creates a Drupal account. Specifically this is happening when a user has commerce cart data in the session, and after account creation, is taken to the next step in the commerce checkout flow, and is denied access because the cart data is removed. I was tempted to think that the data is replaced by the Civi data, now in the session; in fact the session is a completely new one for the user, with a new sid etc. I'm pretty stumped in how to debug this further, so I'm wondering if others have seen anything similar.
  
  Here's what I've found. In the `initialize()` method of the Civi core Session class there is the following check:
  
  ```
      if (($sid = session_id()) !== $this->sessionID) {
        $this->_session = NULL;
        $this->sessionID = $sid;
      }
  
  ```
  
  I'm not completely clear about the utility of this check, but in my case, this is where existing session data is getting set to NULL. I've commented this out and my application appears to be working correctly, with the $\_SESSION variable now storing the commerce cart data as well as the civi data after user login. I would still like to know why this check is there, the only comments are inline above it:
  
  ```
  // remove $_SESSION reference if session is changed
  
  ```
  
  That's a little mysterious, but that's what we have in any case.
  
  Link to lab ticket: <https://lab.civicrm.org/dev/drupal/-/issues/163>
  
  **Tags:** drupal, session, commerce
  
  > **Comments:**
  > **username_1**: Can you disable CiviCRM (with cautions noted) and see if that affects it. if not then this sounds like purely a Drupal question and may be better in the Drupal channel  
  > **username_2**: Which version of Drupal are you using?  Is the user account creation directly in Drupal or via CiviCRM?  
  > **username_0**: I should have been more clear, the $_SESSION is getting replaced in vendor/civicrm/civicrm-core/CRM/Core/Session.php. I've been debugging line 270 which is `$this->createScope($prefix, TRUE);`, but it's called so many times during login that I haven't been able to pinpoint the condition that is causing `createScope()` to get rid of the current session.  
  > **username_0**: Sorry, the app is using Drupal 9.2.2.  
  
  ---
  
  ## 0 answers
  
  