-
-
Notifications
You must be signed in to change notification settings - Fork 299
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[HttpFoundation][FrameworkBundle] fix support for samesite in session…
… cookies
- Loading branch information
1 parent
7a2ab8c
commit 4d440be
Showing
10 changed files
with
192 additions
and
38 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,59 @@ | ||
| <?php | ||
|
|
||
| /* | ||
| * This file is part of the Symfony package. | ||
| * | ||
| * (c) Fabien Potencier <[email protected]> | ||
| * | ||
| * For the full copyright and license information, please view the LICENSE | ||
| * file that was distributed with this source code. | ||
| */ | ||
|
|
||
| namespace Symfony\Component\HttpFoundation\Session; | ||
|
|
||
| /** | ||
| * Session utility functions. | ||
| * | ||
| * @author Nicolas Grekas <[email protected]> | ||
| * @author Rémon van de Kamp <[email protected]> | ||
| * | ||
| * @internal | ||
| */ | ||
| final class SessionUtils | ||
| { | ||
| /** | ||
| * Find the session header amongst the headers that are to be sent, remove it, and return | ||
| * it so the caller can process it further. | ||
| */ | ||
| public static function popSessionCookie($sessionName, $sessionId) | ||
| { | ||
| $sessionCookie = null; | ||
| $sessionCookiePrefix = sprintf(' %s=', urlencode($sessionName)); | ||
| $sessionCookieWithId = sprintf('%s%s;', $sessionCookiePrefix, urlencode($sessionId)); | ||
| $otherCookies = []; | ||
| foreach (headers_list() as $h) { | ||
| if (0 !== stripos($h, 'Set-Cookie:')) { | ||
| continue; | ||
| } | ||
| if (11 === strpos($h, $sessionCookiePrefix, 11)) { | ||
| $sessionCookie = $h; | ||
|
|
||
| if (11 !== strpos($h, $sessionCookieWithId, 11)) { | ||
| $otherCookies[] = $h; | ||
| } | ||
| } else { | ||
| $otherCookies[] = $h; | ||
| } | ||
| } | ||
| if (null === $sessionCookie) { | ||
| return null; | ||
| } | ||
|
|
||
| header_remove('Set-Cookie'); | ||
| foreach ($otherCookies as $h) { | ||
| header($h, false); | ||
| } | ||
|
|
||
| return $sessionCookie; | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
16 changes: 16 additions & 0 deletions
16
Tests/Session/Storage/Handler/Fixtures/with_samesite.expected
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| open | ||
| validateId | ||
| read | ||
| doRead: | ||
| read | ||
|
|
||
| write | ||
| doWrite: foo|s:3:"bar"; | ||
| close | ||
| Array | ||
| ( | ||
| [0] => Content-Type: text/plain; charset=utf-8 | ||
| [1] => Cache-Control: max-age=0, private, must-revalidate | ||
| [2] => Set-Cookie: sid=random_session_id; path=/; secure; HttpOnly; SameSite=lax | ||
| ) | ||
| shutdown |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| <?php | ||
|
|
||
| require __DIR__.'/common.inc'; | ||
|
|
||
| use Symfony\Component\HttpFoundation\Session\Storage\NativeSessionStorage; | ||
|
|
||
| $storage = new NativeSessionStorage(['cookie_samesite' => 'lax']); | ||
| $storage->setSaveHandler(new TestSessionHandler()); | ||
| $storage->start(); | ||
|
|
||
| $_SESSION = ['foo' => 'bar']; | ||
|
|
||
| ob_start(function ($buffer) { return str_replace(session_id(), 'random_session_id', $buffer); }); |
23 changes: 23 additions & 0 deletions
23
Tests/Session/Storage/Handler/Fixtures/with_samesite_and_migration.expected
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,23 @@ | ||
| open | ||
| validateId | ||
| read | ||
| doRead: | ||
| read | ||
| destroy | ||
| close | ||
| open | ||
| validateId | ||
| read | ||
| doRead: | ||
| read | ||
|
|
||
| write | ||
| doWrite: foo|s:3:"bar"; | ||
| close | ||
| Array | ||
| ( | ||
| [0] => Content-Type: text/plain; charset=utf-8 | ||
| [1] => Cache-Control: max-age=0, private, must-revalidate | ||
| [2] => Set-Cookie: sid=random_session_id; path=/; secure; HttpOnly; SameSite=lax | ||
| ) | ||
| shutdown |
15 changes: 15 additions & 0 deletions
15
Tests/Session/Storage/Handler/Fixtures/with_samesite_and_migration.php
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| <?php | ||
|
|
||
| require __DIR__.'/common.inc'; | ||
|
|
||
| use Symfony\Component\HttpFoundation\Session\Storage\NativeSessionStorage; | ||
|
|
||
| $storage = new NativeSessionStorage(['cookie_samesite' => 'lax']); | ||
| $storage->setSaveHandler(new TestSessionHandler()); | ||
| $storage->start(); | ||
|
|
||
| $_SESSION = ['foo' => 'bar']; | ||
|
|
||
| $storage->regenerate(true); | ||
|
|
||
| ob_start(function ($buffer) { return preg_replace('~_sf2_meta.*$~m', '', str_replace(session_id(), 'random_session_id', $buffer)); }); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters