XBackBone | A lightweight file manager with full ShareX support and more | File Upload library

In Apache HTTP/2 module only certain headers are copied on pushed request.

The full list of headers is listed in the Apache documentation

Apache will look at the original request (the one that triggered the PUSH) and copy the following headers over to PUSH requests: user-agent, accept, accept-encoding, accept-language, cache-control.

All other headers are ignored. Cookies will also not be copied over. PUSHing resources that require a cookie to be present will not work. This can be a matter of debate. But unless this is more clearly discussed with browser, let's err on the side of caution and not expose cookie where they might oridinarily not be visible.

Note how it explicitly calls out that cookies will not be sent. Therefore there is no session and so your PHP app is setting a new one.

HTTP/2 push is intended to send safe, cacheable resources and Apache has chosen to interpret this has non-authenticated resources. Therefore unless you can serve your pushed resource without requiring cookies, you should not push it.

You can use the preload header with the nopush attribute to avoid pushing it, but still have the browser request it with high priority. As the browser is requesting it, it will send the appropriate cookies and all should work. It may not be quiet as fast as push but it’s often good enough. Additionally as browsers are aware of their cache, using preload instead of push is often recommended anyway. Push is complicated to get right - and not just because of the issue you’ve spotted here.