NEW: Move session activation to SessionMiddleware.

_config/requestprocessors.yml

@@ -3,6 +3,7 @@ Name: requestprocessors
 ---
 SilverStripe\Control\Director:
   middlewares:
+    SessionMiddleware: 'SilverStripe\Control\SessionMiddleware'
     RequestProcessor: 'SilverStripe\Control\RequestProcessor'
     FlushMiddleware: '%$SilverStripe\Control\FlushMiddleware'
 

src/Control/Director.php

@@ -132,13 +132,7 @@ class Director implements TemplateGlobalProvider
         }
 
         // Generate output
-        $result = static::handleRequest($request);
-
-        // Save session data. Note that save() will start/resume the session if required.
-        $request->getSession()->save();
-
-        // Return
-        return $result;
+        return static::handleRequest($request);
     }
 
     /**

src/Control/HTTPApplication.php

@@ -96,8 +96,6 @@ class HTTPApplication implements Application
 
         // Ensure boot is invoked
         return $this->execute($request, function (HTTPRequest $request) {
-            // Start session and execute
-            $request->getSession()->init();
             return Director::direct($request);
         }, $flush);
     }

src/Control/SessionMiddleware.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace SilverStripe\Control;
+
+class SessionMiddleware implements HTTPMiddleware
+{
+
+    /**
+     * @inheritdoc
+     */
+    public function process(HTTPRequest $request, callable $delegate)
+    {
+        try {
+            // Start session and execute
+            $request->getSession()->init();
+
+            // Generate output
+            $response = $delegate($request);
+
+        // Save session data, even if there was an exception.
+        // Note that save() will start/resume the session if required.
+        } finally {
+            $request->getSession()->save();
+        }
+
+        return $response;
+    }
+}