I've noticed that my /var/session/ folder has been filling up really quickly lately so I decided to open a few of the files up to see where they were being generated from. Most of them were bots such as SEMRush or Bing generating files such as the below:


_secure_cookie_check|s:32:"9f01d3ce7854010140a04e28e8ea1ff2";core|a:4:{s:23:"_session_validator_data";a:5:{s:11:"remote_addr";s:12:"";s:8:"http_via";s:0:"";s:20:"http_x_forwarded_for";s:0:"";s:15:"http_user_agent";s:71:"Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)";s:24:"session_expire_timestamp";i:1532950280;}s:8:"messages";O:34:"Mage_Core_Model_Message_Collection":2:{s:12:" * _messages";a:0:{}s:20:" * _lastAddedMessage";N;}s:12:"visitor_data";a:15:{s:0:"";N;s:11:"server_addr";s:4:"mËsš";s:11:"remote_addr";s:4:"Ï. K";s:11:"http_secure";b:1;s:9:"http_host";s:23:"www.removedforsecuritypurposes.com";s:15:"http_user_agent";s:71:"Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)";s:20:"http_accept_language";s:0:"";s:19:"http_accept_charset";s:0:"";s:11:"request_uri";s:29:"/catalog/category/view/id/421";s:10:"session_id";s:26:"temfgjqqf4o0miijgedvcf7nq6";s:12:"http_referer";s:0:"";s:14:"first_visit_at";s:19:"2018-07-30

But I've noticed there are loads of Chinese looking files being generated such as below.



Is it possible the session folder is somehow being hacked, or could something else be generating these files? Would Chinese/Japanese browsers generate their own language into these files? We have a very secure server and always make sure our website is using the latest patches so it's all a little strange!

  • The translation of the Chinese text, nor the Chinese version itself looks like a valid session file. Are the file permissions for your /car folder set up correctly? – Anna Völkl Jul 30 '18 at 19:45
  • Yes, all my permissions are as per a default Magento installation. – Liam McArthur Jul 31 '18 at 8:19
  • Did you ever solve this as I am havint the same issue with a Magento 2.3.1 upgrade and it is causing issues along the the lines of: Failed to decode session object session destroyed etc etc Be great to know where you got to with this? Thanks Matt – Matt Jun 6 at 9:22
  • If you have a new question, please ask it by clicking the Ask Question button. Include a link to this question if it helps provide context. - From Review – Manashvi Birla Jun 6 at 10:04
  • This does not really answer the question. If you have a different question, you can ask it by clicking Ask Question. You can also add a bounty to draw more attention to this question once you have enough reputation. - From Review – sv3n Jun 6 at 10:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.