SessionAuthenticationStrategy.php 1.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869
  1. <?php
  2. /*
  3. * This file is part of the Symfony package.
  4. *
  5. * (c) Fabien Potencier <fabien@symfony.com>
  6. *
  7. * For the full copyright and license information, please view the LICENSE
  8. * file that was distributed with this source code.
  9. */
  10. namespace Symfony\Component\Security\Http\Session;
  11. use Symfony\Component\HttpFoundation\Request;
  12. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  13. /**
  14. * The default session strategy implementation.
  15. *
  16. * Supports the following strategies:
  17. * NONE: the session is not changed
  18. * MIGRATE: the session id is updated, attributes are kept
  19. * INVALIDATE: the session id is updated, attributes are lost
  20. *
  21. * @author Johannes M. Schmitt <schmittjoh@gmail.com>
  22. */
  23. class SessionAuthenticationStrategy implements SessionAuthenticationStrategyInterface
  24. {
  25. const NONE = 'none';
  26. const MIGRATE = 'migrate';
  27. const INVALIDATE = 'invalidate';
  28. private $strategy;
  29. public function __construct($strategy)
  30. {
  31. $this->strategy = $strategy;
  32. }
  33. /**
  34. * {@inheritdoc}
  35. */
  36. public function onAuthentication(Request $request, TokenInterface $token)
  37. {
  38. switch ($this->strategy) {
  39. case self::NONE:
  40. return;
  41. case self::MIGRATE:
  42. // Note: this logic is duplicated in several authentication listeners
  43. // until Symfony 5.0 due to a security fix with BC compat
  44. // Destroying the old session is broken in php 5.4.0 - 5.4.10
  45. // See https://bugs.php.net/63379
  46. $destroy = \PHP_VERSION_ID < 50400 || \PHP_VERSION_ID >= 50411;
  47. $request->getSession()->migrate($destroy);
  48. return;
  49. case self::INVALIDATE:
  50. $request->getSession()->invalidate();
  51. return;
  52. default:
  53. throw new \RuntimeException(sprintf('Invalid session authentication strategy "%s"', $this->strategy));
  54. }
  55. }
  56. }