I am currently searching for a way to implement single session in symfony 3.3, what I want is that if I log in from one browser then log in from another browser on the same user, I want to be logged out from the first session.
A non simple way would be to store the latest session id in the user entity and then query that on every request, if the session id is not the same and older then the user gets redirected to the logout route.
I was wondering if anyone knows a simpler way to implement this which might not be in the symfony documentation.
Thanks.
I solved this by using redis cache instead, I saved the user id as a key and the session id as the data inside the key. Then on every request I searched in redis if there was a key for the current user. If not then I created a key for that user with the session id as the data. If yes then I checked if the session id inside the key was the same as the current session id. If it was the same then I just continued normally, if not I deleted the old session from the session handler and put the new session inside the key.
I also use redis as session handler so I just called destroy on the old session id.
Related
I ned to set a session per every user, so when the user log ou from his account and login again in another account the old session will not be shown but the new that related to his new account will be shown
I am using the normal method in laravel to do it
Session::put('key', 'value');
But the problem as explained is that the session will br shown in all user using this computer
Session ids are supposed to be non-guessable. You're going to have to resolve (attempted) duplicates serverside. If you search through every existing session for a match then your not going to be able to scale this / its going to be very slow. That means you need an access path to the session data based on the username AS WELL AS the session id.
There are lots of solutions to this. I don't think any of them are exposed directly in Laravel.
You need to deal with maintaining the mapping directly in the session management - so you will need a custom session handler. The session handler deals with serialized data - so you need to think about how the username is resolved within the session handler. You could put it in the session and deserialize the data again the handler, or read the value from a global variable. Or you could write a prototytype of the session into a database with the sessionid as the primary key and the username as an indexed lookup before the session close handler is called.
Another approach would be to store the session as the username rather than using the session id. You still need to protect the username though and avoid session fixation, hence you would need to explicity generate the session id using a mechansim where only you can recover the username from it, e.g.
$data=array($username, openssl_random_pseudo_bytes(16));
$sessionid = encrypt(serialize($data), $your_secret_key);
(You still need to write your own session handler for this).
I need to save payment data in DB. So one of the ways is to store the data into session and in saving part do the rest.
I save it like this:
$request->session()->put('paymentData', $request->all());
And then in another controller I call the same session, do some things and then remove the session:
$data = $request->session()->get('paymentData', 'default');
// do some DB storing
// delete session
$request->session()->forget('paymentData');
My question is, if two users are doing payments at same time. Can it happen that they mix these sessions because they will access it under the same name paymentData? Session will be stored in file in storage\session. Or Laravel have some method to distinguish these two Sessions even though they have the same name/key?
Sessions are created per browser session. The Session instance is accessed by a specific session ID. The browser keeps the session ID in a cookie and sends it every time it makes a request, so the server knows which session to use for that request.
What you put within the session can be duplicated no problem - other users cannot see that data (unless they somehow obtain the session ID by a browser attack).
I'm trying to wrap my head around how Laravel handles session data without digging too deeply into the code, due to time contraints.
It appears that the session ID ('laravel_session', by default) which is stored in a cookie is encrypted, because it is a different, much longer value than I get if I print the value of Session::getId()
So I'm assuming that Laravel is encrypting this value before dropping the cookie, and then decrypting the value to do the session data look-up every time session data is required.
So I guess my first question is:
1. Why is the session ID obfuscated like this? I'm presuming that it is for security purposes?
Secondly, I see no 'user_id' (or similarly worded) key in the actual session data once it has been pulled from disk. In fact, the only thing I see aside from the CSRF _token value is some entry like 'login_42e5d2c566bd0811218f0cf078b76bfd' = 1.
2. What is this data responsible for?
3. Can someone please give me a brief overview of how Laravel associates the session data with a specific user ID?
Why are you digging into the session to get the user ID? You can have sessions without logging in - so user ID doesnt always mean something.
If you want the currently logged in user - then you should be using Auth::user()->id
What is the best way to check in Symfony2 if a session (not the current) by sessionID is expired.
I have a database e.g. id|sessionId|someData and I want to create a command that remove all rows which sessions are expired.
If you're using the default symfony session handling which relies on php-sessions you're out of luck.
As soon as your session is expired you get a new one.
However if you access to the session save path you might try the accepted answer in this question:
Check if PHP session_id is in use
I have some questions about the mechanism of session in code igniter framework:
1. isn't it exactly like working with a cookie? because what I have seen is that all the session data is send back as a cookie to the browser. so when another request is made then all the data is sent back with the cookie session.
2. the session data is sent back to the browser. even though it is encrypted, I can still identify all the session items, so isn't it easy to change the encrypted value of that item to an encrypt value, like changing an item called loged_in from false to true
3. when saving session data in a database, is the session data automatically deleted?
4. why is it written in code igniter documentation that "Session IDs can never be updated, they can only be generated when a new session is created". so when regenerating the session id in the cookie session how will we be able to compare it to the session id that is stored in the database?
The Session class does not utilize native PHP sessions. CI session library generates cookie when you initialize session in CodeIgniter. So actually sessions in CodeIgniter is a Cookie.
Setup Encryption Key on your config.php file and I'm sure that will resolve an issue you are having. Even CI session document says - "Even if you are not using encrypted sessions, you must set an encryption key in your config file which is used to aid in preventing session data manipulation."
I personally never tried DB Session but YES CI deletes expired sessions stored in DB. CI Documentation says - "The Session class has built-in garbage collection which clears out expired sessions", which explains pretty much about this question.
CI has taken care of this situation. When regenerating session id, CI replaces old session id stored in DB with new session id. If you can take a look in to Session library; check for sess_update() method for more details and you can see how CI is updating new session id in DB.