Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

use a lib for server side sessions #954

Closed
davidcoutadeur opened this issue Aug 2, 2024 · 2 comments · Fixed by #967
Closed

use a lib for server side sessions #954

davidcoutadeur opened this issue Aug 2, 2024 · 2 comments · Fixed by #967
Assignees
@davidcoutadeur
Labels
enhancement
Milestone
1.7.0

Comments

@davidcoutadeur
Copy link

The goal is to remove things like:

htdocs/sendtoken.php:    ini_set("session.use_cookies",0);
htdocs/sendtoken.php:    ini_set("session.use_only_cookies",1);

in htdocs/sendtoken.php, htdocs/resetbytoken.php, htdocs/sendsms.php (but not necessarily for lib/captcha/InternalCaptcha.php which needs a session maintained at client side)

For this, we need to find a way to maintain server side sessions. Ideally with multiple possibilities of storage (file, redis,...)

Depending on the complexity, maybe we won't have time for doing this in 1.7.0.
@davidcoutadeur davidcoutadeur added this to the 1.7.0 milestone Aug 2, 2024
@davidcoutadeur davidcoutadeur self-assigned this Aug 2, 2024
@davidcoutadeur
Copy link
Author

See also the conversation in this PR: https://github.com/ltb-project/self-service-password/pull/949/files#diff-60c04a04215ce092db74c81c7eaf4bf5e6c49f796b4ae6e3c526ce70758f33f6

davidcoutadeur pushed a commit that referenced this issue Aug 28, 2024
use symfony cache for managing session-side storage (#954)
0074476
@davidcoutadeur davidcoutadeur mentioned this issue Aug 28, 2024
Merged
@davidcoutadeur
Copy link
Author

davidcoutadeur commented Aug 28, 2024 •
edited
Loading

I have found and implemented a solution based on Symfony cache.

See #967

It's quite extendable. For example, we could define another storage simply: memcached, redis,... Complete list here: https://symfony.com/doc/current/components/cache/cache_pools.html

TODO:

  • add documentation. At least add an upgrade note for explaining the loss of previous sessions
  • manage cache expiration for each use case, especially when there is already an expiration defined in the token saved in cache
  • add some cache parameters in default configuration file
  • test more deeply the new feature
  • reference new composer dependency in debian, red-hat packages, and select appropriate version of symfony/cache in composer.json

davidcoutadeur pushed a commit that referenced this issue Sep 6, 2024
symfony cache doc, conf, and improvements (#954)
a6963df 
- add upgrade notes,
- add cache parameters in config,
- remove expired cache entries,
- remove some warning messages,
- security: always display the same message: invalid token even if the user is not found in ldap,
- add more logs,
- set an expiration time for each cache entry
davidcoutadeur pushed a commit that referenced this issue Sep 9, 2024
set symfony/cache version (#954)
7fb1974
davidcoutadeur pushed a commit that referenced this issue Sep 9, 2024
adding new cache bundled dependencies in packages and doc (#954)
5ad0bb9
davidcoutadeur pushed a commit that referenced this issue Sep 9, 2024
use symfony cache for managing session-side storage (#954)
db3a21f 
- use symfony cache for managing sessions,
- add upgrade notes,
- add 2 cache parameters in config,
- remove expired cache entries,
- remove some warning messages,
- security: always display the same message: invalid token even if the user is not found in ldap,
- add more logs,
- set an expiration time for each cache entry,
- set symfony/cache version in composer.json,
- adding new cache bundled dependencies in packages and doc
davidcoutadeur pushed a commit that referenced this issue Sep 9, 2024
@davidcoutadeur
use symfony cache for managing session-side storage (#954)
8079006 
- use symfony cache for managing sessions,
- add upgrade notes,
- add 2 cache parameters in config,
- remove expired cache entries,
- remove some warning messages,
- security: always display the same message: invalid token even if the user is not found in ldap,
- add more logs,
- set an expiration time for each cache entry,
- set symfony/cache version in composer.json,
- adding new cache bundled dependencies in packages and doc
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@davidcoutadeur davidcoutadeur

Labels
enhancement
Projects
None yet
Milestone
1.7.0
Development

Successfully merging a pull request may close this issue.

use symfony cache for managing session-side storage (#954) ltb-project/self-service-password
1 participant
@davidcoutadeur