cakephp: Json View not being rendered if Session is written to before render() is called

This is a (multiple allowed):

• bug

• enhancement

• feature-discussion (RFC)

• CakePHP Version: 2.8.9

• Platform and Target: PHP 7.1, nginx, Ubuntu 14.04 LTS

What you did

We have set up JSON extension parsing in our routes.php:

Router::parseExtensions('rss', 'json', 'xml', 'json', 'pdf');

We use this to handle API responses, example url: /lists.json and so far it worked.

What happened

So far we’ve been using echo json_encode($data); and this worked fine but is hard to test, so we started replacing it with the following snippet:

$this->set('response', $data);
$this->render('json');
return true;

And we have a ‘json.ctp’ view file that just has <?php echo json_encode($response);?>.

Early in the Controller we have credential checking and session handling. If the credential check fails, it correctly renders the ‘json.ctp’ view file, with the error response. But, if the credential check succeeds, and we use $this->Auth->login();, then the view won’t render at all. At that point it doesn’t use the layout nor the view file, although the view “vars” are set.

I was able to narrow it down to this line in Auth->login(): $this->Session->write(static::$sessionKey, $user);, when that is commented out, it works. Also, when we use the non-json url /lists, it also works.

What you expected to happen

Expected $this->render('json'); to render the json.ctp view file, but it silently fails.