yiisoft / session Goto Github PK

Hi guys，my application run with swoole, I found I can not use SessionMiddleware because Session will be overwrite by other request.
Could we add Session into attribute of request, so we can use the way $request->getAttribute(SessionInterface::class) to get Session.
We also can remain old usage by add a new property when application running different env.

Funding

• You can sponsor this specific effort via a Polar.sh pledge below
• We receive the pledge once the issue is completed & verified

At the moment, the Session class cannot function on its own without SessionMiddleware, since the Session::setId method must be called to work correctly with sessions.

I suggest adding a section to [README.md] (/yiisoft/session/blob/master/README.md):

Using Session without SessionMiddleware

If you want to use the functionality of the Session class without the SessionMiddleware class, you need to get the session identifier yourself (from the request) when creating the Session instance (or before using it for the first time) and pass it to the Session class instance via the Session::setId method.

На данный момент класс Session не может функционировать самостоятельно без SessionMiddleware, так как для корректной работы с сессиями требуется вызов метода Session::setId.

Предлагаю добавить в README.md раздел:

Использование Session без SessionMiddleware

Если вы хотите использовать функционал класса Session без класса SessionMiddleware, вам необходимо при создании экземпляра Session (или до первого его использования), самостоятельно получить идентификатор сессии (из запроса) и передать его в экземпляр класса Session через метод Session::setId.

https://github.com/yiisoft/session/blob/master/src/Flash/Flash.php#L16 this state is likely to result in issues when working in RoadRunner environment.

I suggest not to open a session for reading / clearing session data if the session ID is not set.

The absence of a session identifier indicates that there is no saved session. In this case, there is no need to create an empty session when reading data.

For example, when reading flash messages, this functionality will no longer start a session if it was not there before.

Currently it is not documented enough and what's documented is Yii-specific.

1. Need a general installation guide.
2. Need either a reference to Yii guide on sessions or expanded description of opening and closing session, working with session data, implementing a custom storage, and using flash messages.

Prerequisite:
There is no session cookie set up for the domain using for test.

Steps to reproduce:
Add SessionMiddleware to the middlewares used by the application

In the controller call:

1. $session->open();
2. $session->set('key', 'value');
3. $session->close();

Expected result: there is a Set-Cookie header (PHPSESSID) in the response.

Actual result: there is no Set-Cookie header in the response.

It is said in the documentation:

Note: Closing session as early as possible is a good practice since many session implementations are blocking other requests while session is open.

It shoud be either fixed in the documentation to forbid closing session manually, or should be fixed in the code to send a cookie for a manually closed session.

What steps will reproduce the problem?

$v = new \Yiisoft\Session\Session([
    'name' => 'customname',
]);

What is the expected result?

Yiisoft\Session\Session::getName would return $this->options['name] if available (or first check whether there’s an active session) before resorting to session_name().

What do you get instead?

a fresh session and new session cookie each response

Additional info

session_name() always returns PHPSESSID when there’s been no session started yet.

Currently custom PHPUnit formatter is used since standard PHP session engine writes to stdout and it can't do so twice.

It seems Infection can not use custom formatter so I've found no way to run mutation tests so far.