session_start() required for reading $_SESSION

Question

Let's say we have index.php which calls session_start() and populates $_SESSION data.
While the user is on the webpage, they click a button and an AJAX query is kicked off to ajax.php . ajax.php does not call session_start(), but it is successfully reading the data in $_SESSION.

Is this expected behavior?

Answer 1

If you look at the output of a phpinfo(); call you will probably notice that the session.auto_start configuration variable is set to 1.

See documentation for further reference. Unless this flag is set it is definitely not expected behaviour, and you are probably including code somewhere that explicitly invokes session_start().