services_session_restart fails to create a session when client does not accept cookies

Certainly something we need to look at in preperation for getting this into D7.

Maybe adding this before call to sess_read() (inside services_session_restart() function) will help?

  if (!isset($_COOKIE[session_name()])) $_COOKIE[session_name()] = session_id();

I spent quite a bit of time trying to work this out when I first wrote services, but ended up setting it aside as I haven't had a use for session IDs myself. You're right about the problem, Drupal does not allow sessions without cookies, so it may take a patch to core to make this happen. Otherwise, services will probably have to have it's own session code.

I'm sorry, i forgot to add important parto of explanation: code i pasted above should be added in services.module :). No need to patch core for that.
I'm attaching tiny patch for review. Can someone test it with some xmlrpc client? Maybe try to use it with user_service and patched node_service (so it checks node_access) modules?

More of the issue is that during the drupal bootstrap a session gets started by session_start(). The php docs say that subsequent calls to session_start() are ignored, so services is way to late to do anything with the session. We'll have to modify core in some way

Right. But why do we really need to restart session?
If i understood description of this issue correctly, whole thing is about logging in and calling services as logged in user (with some specific access permissions). We don't really need to regenerate session_id, create new session, etc... we can use current session all the time (nevermind that it has different id than the one we got after logging in :).
Here is how it could work (correct me if i'm wrong :).

1. client connects and calls user.login function
2. drupal creates session with ID = A
3. user.login authenticates user and returns sessid A (BTW user.module regenerates session_id in user_login_submit() function. is it really needed? :).
4. drupal saves session A with user data

5. client connects and calls node.save function (modified to check permissions with node_access call)
6. drupal creates session with ID = B (new session is created because client doesn't handle cookies and PHP thinks it's new client)
7. services gets sessid = A from arguments passed from client
8. services calls sess_read(A) which makes user logged in
9. services calls node.save method
10. services calls session_destroy() to prevent user data propagating to many sessions

So in short:
1. remove services_session_restart() function
2. instead of calling services_session_restart() call sess_read($sssid).
3. after method call returns, call session_destroy() before returning from services_method_call() function.

The only problem is that if something updates $_SESSION variable, it will not be saved for next call from client. But we could workaround even that by loading session data (session_decode(sess_read($ssid))) and then encoding it again and calling sess_write($ssid, session_encode()) before session_destroy();
More about tricks with session data here: http://pl2.php.net/manual/en/function.session-decode.php#69111 (so basically, we can split that function in half, and call service method in the middle :).

sess_read() always checks for a cookie. Thus the above method will fail, as one is not set.

And that is where code from patch i made comes in and saves the day ;).

I tested this patch with an xmlrpc client, seems to solve the problem. Can somebody else double check this before I commit. Also attached a patch for D6.

This does indeed fix this issue. Albeit in a slightly hackish way, oh well, such is life.

I also tested it with Flash (and amfphp module) - it works ok.

But maybe it would be better to create bigger patch, with changes i described above (http://drupal.org/node/231869#comment-804519 -> loading session to current one, making method call, saving session to user's session and cleaning current session)?

OK, here is more "advanced" patch. It takes session data into account. It also doesn't mess with sessions if current user data was already loaded ($user->sid == $sessid).

I tested it with Flash+amfphp and it works ok (even better than before because user.logout actually logs me out of Drupal ;).
AFAIK Flash does handle cookies (only they are separate from browser's cookies), so if someone could try it with XMLRPC it would be great.

Committed drupal 5 and drupal 6