[WIP] [Security] Session concurrency control #12009
Conversation
|
|
||
| while ($data = $statement->fetch(\PDO::FETCH_ASSOC)) { | ||
| $sessionInformations[] = $this->instantiateSessionInformationFromResultSet($data); | ||
| } |
There was a problem hiding this comment.
you should call $statement->closeCursor() at the end of the iteration to close the cursor so that memory can be reclaimed by the DB driver
|
Impressive work @ajgarlag! It's a really big PR and targets one of the most difficult parts of Symfony. |
|
Thanks @javiereguiluz. I've fought with the Security component several times in the past, but I think I will never understand it fully. Anyway, this PR couldn't be possible without the previous work by @paschke in #786. |
54e2d41 to
fccc826
Compare
4fda8da to
24c2120
Compare
|
@fabpot @schmittjoh Any feedback for this |
|
Hey! look at #12284 for CS ! |
… the Spring framework name. Rename allowableSessionsExceeded to allowedSessionsExceeded.
24c2120 to
4ca3a47
Compare
…sion registry on logout.
|
After reviewing the PR, I've discovered that two different concerns are involved here, so I've split it in two different PRs. I close this PR in favor of the other ones:
|
This PR is based on #786 by @paschke. The most important changes from this PR are listed below:
Symfony\Bundle\SecurityBundle\DependencyInjection\Security\Factory\SecurityFactoryInterfaceto maintain BC.Symfony\Bridge\Doctrine\Security\SessionRegistry\SessionRegistryStorageis borrowed fromSymfony\Component\HttpFoundation\Session\Storage\Handler\PdoSessionHandlerSymfony\Component\Security\Http\Session\CompositeSessionAuthenticationStrategyclass exits to wrap the actual SessionAuthenticationStrategy, and to split the concurrency control in two steps: the first one checks the concurrency, the last one registers the session information in the registry.firewalls.secured_area.session_concurrency.error_if_maximum_exceededallows you to configure the default behaviour when session concurrency is detected: to avoid a new login, or to expire the oldest sessions.Symfony\Component\Security\Http\Firewall\ConcurrentSessionListeneris renamed toSymfony\Component\Security\Http\Firewall\ExpiredSessionListener