[2.1][HttpFoundation] Added some basic meta-data to Session #3718

ghost · 2012-03-28T23:29:35Z

Bug fix: no
Feature addition: yes
Backwards compatibility break: no
Symfony2 tests pass: yes
References the following tickets: #2171
Todo: -

Session data is stored as an encoded string against a single id. If we want to store meta-data about the session, that data has to be stored as part of the session data to ensure the meta-data can persist using any session save handler.

This patch makes it much easier to determine the logic of session expiration. In general a session expiry can be dealt with by the gc handlers, however, in some applications more specific expiry rules might be required.

Session expiry may also be more complex than a simple, session was idle for x seconds. For example, in Zikula there are three security settings, Low, Medium and High. The rules for session expiry are more complex as under the Medium setting, a session will expire after x minutes idle time, unless the rememberme option was ticked on login. If so, the session will not idle. This gives the user some control over their experience. Under the high security setting, then there is no option, sessions will expire after the idle time is reached and login the UI has the rememberme checkbox removed.

The other advantage is that under this methodology, there can be a UI experience on expiry, like "Sorry, your session expired due to being idle for 10 minutes".

Keeping in the spirit of Symfony2 Components, I am seeking to make session handling flexible enough to accommodate these general requirements without specifically covering expiration rules. It would mean that it would be up to the implementing application to specifcally check and expire session after starting it.

Expiration might look something like this:

$session->start();
if (time() - $session->getMetadataBag()->getLastUpdate() > $maxIdleTime) {
    $session->invalidate();
    throw new SessionExpired();
}

This commit also brings the ability to change the cookie_lifetime when migrating a session. This means one could move from a default of browser only session cookie to long-lived cookie when changing from a anonymous to a logged in user for example.

$session->migrate($destroy, $lifetime);

jalliot · 2012-03-29T07:45:55Z

src/Symfony/Component/HttpFoundation/Session/MetaBag.php

+    /**
+     * Constructor.
+     *
+     * @param string $storageKey The key used to store flashes in the session.


typo here: flashes -> meta

ghost · 2012-03-30T18:18:43Z

@fabpot I have removed [WIP] status.

Tobion · 2012-03-30T20:53:09Z

src/Symfony/Component/HttpFoundation/Session/Session.php

+     *
+     * @return MetaBag
+     */
+    public function getMeta()


I disagree with the naming.

The word meta alone makes no sense here. I guess you mean metadata.

The method is missing the Bag suffix to be in line with getFlashBag

So the method name should be getMetadataBag and the class must also be renamed accordingly.

To be honest, getFlashBag() is only named as such because it conflicts with a method kept for BC. While this is a bag, it's also not really a bag in the sense of being optional. I agree that maybe Metadata is more explicit but meta does actually mean the same thing, abstract information which is what meta-data is. I would feel more inclined to remove Bag suffix in all references to this particular bag and just call it Metadata getMetadata() etc.

This commit allows applications to know certain meta-data about the session Session storage is designed to only store some data against a session ID so this method is necessary to be compatible with any session handler, including native handlers.

SessionStorageInterface Added cookie_lifetime to the meta-data. This allows to know how old a cookie is and when the cookie will expire.

…session cookie expiry-time)

…ime on migrate(). This is a very important option which allows the cookie lifetime to be changed on migrate. For example when a user converts from an anonymous session to a logged in session one might wish to change from a persistent cookie to browser session (e.g. a banking application).

ghost · 2012-03-31T13:34:57Z

NB: This PR has been rebased and the tests relocated as per recent master changes.

Tobion · 2012-03-31T14:53:24Z

src/Symfony/Component/HttpFoundation/Tests/Session/Storage/MetadataBagTest.php

+
+    public function testInitialize()
+    {
+        $p = new \ReflectionProperty('Symfony\Component\HttpFoundation\Session\Storage\MetadataBag', 'meta');


This is not used anywhere. And meta property doesn't even exist.

$p is used a little down in lines 57 and 65. The property value change was missing when I renamed the class, it's been fixed now.

ghost · 2012-04-03T02:16:43Z

@fabpot - ping

fabpot · 2012-04-03T09:40:46Z

@Drak: again, after I merge this PR, can you make sure that everything is documented properly in the documentation? Probably within a new cookbook article. Thanks.

@fabpot

Commits ------- 8a0e6d2 [HttpFoundation] Update changelog. 4fc04fa [HttpFoundation] Renamed MetaBag to MetadataBag 2f03b31 [HttpFoundation] Added the ability to change the session cookie lifetime on migrate(). 39141e8 [HttpFoundation] Add ability to force the lifetime (allows update of session cookie expiry-time) ec3f88f [HttpFoundation] Add methods to interface 402254c [HttpFoundation] Changed meta-data responsibility to SessionStorageInterface d9fd14f [HttpFoundation] Refactored for moved tests location. 29bd787 [HttpFoundation] Added some basic meta-data to Session Discussion ---------- [2.1][HttpFoundation] Added some basic meta-data to Session Bug fix: no Feature addition: yes Backwards compatibility break: no Symfony2 tests pass: yes References the following tickets: #2171 Todo: - Session data is stored as an encoded string against a single id. If we want to store meta-data about the session, that data has to be stored as part of the session data to ensure the meta-data can persist using any session save handler. This patch makes it much easier to determine the logic of session expiration. In general a session expiry can be dealt with by the gc handlers, however, in some applications more specific expiry rules might be required. Session expiry may also be more complex than a simple, session was idle for x seconds. For example, in Zikula there are three security settings, Low, Medium and High. The rules for session expiry are more complex as under the Medium setting, a session will expire after x minutes idle time, unless the rememberme option was ticked on login. If so, the session will not idle. This gives the user some control over their experience. Under the high security setting, then there is no option, sessions will expire after the idle time is reached and login the UI has the rememberme checkbox removed. The other advantage is that under this methodology, there can be a UI experience on expiry, like "Sorry, your session expired due to being idle for 10 minutes". Keeping in the spirit of Symfony2 Components, I am seeking to make session handling flexible enough to accommodate these general requirements without specifically covering expiration rules. It would mean that it would be up to the implementing application to specifcally check and expire session after starting it. Expiration might look something like this: $session->start(); if (time() - $session->getMetadataBag()->getLastUpdate() > $maxIdleTime) { $session->invalidate(); throw new SessionExpired(); } This commit also brings the ability to change the `cookie_lifetime` when migrating a session. This means one could move from a default of browser only session cookie to long-lived cookie when changing from a anonymous to a logged in user for example. $session->migrate($destroy, $lifetime); --------------------------------------------------------------------------- by drak at 2012-03-30T18:18:43Z @fabpot I have removed [WIP] status. --------------------------------------------------------------------------- by drak at 2012-03-31T13:34:57Z NB: This PR has been rebased and the tests relocated as per recent master changes. --------------------------------------------------------------------------- by drak at 2012-04-03T02:16:43Z @fabpot - ping

stof · 2012-04-03T10:04:46Z

@fabpot This is already documented. @weaverryan merged the doc PR a few hours ago and these changes were part of it

ghost · 2012-04-03T10:53:44Z

Yes, the PR was symfony/symfony-docs#1191

jalliot reviewed Mar 29, 2012
View reviewed changes

This was referenced Mar 30, 2012

Make it possible to set keep alive sessions #2171

Closed

[HttpFoundation] Information about garbage collection and session expiry symfony/symfony-docs#1191

Merged

Tobion reviewed Mar 30, 2012
View reviewed changes

Drak added 6 commits March 31, 2012 19:12

[HttpFoundation] Refactored for moved tests location.

d9fd14f

[HttpFoundation] Changed meta-data responsibility to

402254c

SessionStorageInterface Added cookie_lifetime to the meta-data. This allows to know how old a cookie is and when the cookie will expire.

[HttpFoundation] Add methods to interface

ec3f88f

[HttpFoundation] Add ability to force the lifetime (allows update of …

39141e8

…session cookie expiry-time)

Tobion reviewed Mar 31, 2012
View reviewed changes

Drak added 2 commits March 31, 2012 22:36

[HttpFoundation] Renamed MetaBag to MetadataBag

4fc04fa

[HttpFoundation] Update changelog.

8a0e6d2

fabpot merged commit 8a0e6d2 into symfony:master Apr 3, 2012

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[2.1][HttpFoundation] Added some basic meta-data to Session #3718

[2.1][HttpFoundation] Added some basic meta-data to Session #3718

ghost commented Mar 28, 2012

jalliot Mar 29, 2012

ghost Mar 29, 2012

ghost commented Mar 30, 2012

Tobion Mar 30, 2012

ghost Mar 31, 2012

ghost commented Mar 31, 2012

Tobion Mar 31, 2012

ghost Mar 31, 2012

ghost commented Apr 3, 2012

fabpot commented Apr 3, 2012

stof commented Apr 3, 2012

ghost commented Apr 3, 2012

[2.1][HttpFoundation] Added some basic meta-data to Session #3718

[2.1][HttpFoundation] Added some basic meta-data to Session #3718

Conversation

ghost commented Mar 28, 2012

jalliot Mar 29, 2012

Choose a reason for hiding this comment

ghost Mar 29, 2012

Choose a reason for hiding this comment

ghost commented Mar 30, 2012

Tobion Mar 30, 2012

Choose a reason for hiding this comment

ghost Mar 31, 2012

Choose a reason for hiding this comment

ghost commented Mar 31, 2012

Tobion Mar 31, 2012

Choose a reason for hiding this comment

ghost Mar 31, 2012

Choose a reason for hiding this comment

ghost commented Apr 3, 2012

fabpot commented Apr 3, 2012

stof commented Apr 3, 2012

ghost commented Apr 3, 2012