Using session in WP without trouble with the API REST

The only way to make this go away is to not use PHP sessions and use cookies directly instead.

PHP sessions are fundamentally incompatible with a lot of page caching and CDN mechanisms e.g. cloudflare, Varnish, or full page caching plugins such as batcache or WP Supercache. PHP Sessions are also turned off and disabled on a lot of WP hosts e.g. WP Engine.

You cannot rely on PHP sessions in WordPress, especially if you want to write portable code or sell themes/plugins.

PHP Sessions also can’t be used to bypass cookies as the session ID itself is stored in a cookie. There are also security consequences as the user can change this ID in the browser dev tools to retrieve the information of other users. This is much harder with cookie based sessions. In PHP sessions the data is stored server side so I only need to know the right ID for the application to fetch the other persons session details. In cookie based sessions though the data is sent in the HTTP request and is not persisted in server memory, so I need to steal that cookie from your machine to impersonate you which is easier said than done.

Instead use standard cookies. e.g. setcookie( 'key', 'value' );. This is what WordPress itself does, it’s also how a lot of e-commerce sites implement carts ( think for a moment, how do sites that aren’t built in PHP do it? PHP sessions are unnecessary ).