[Security] Session concurrency control #12810
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,55 @@ | ||
| <?php | ||
|
|
||
| /* | ||
| * This file is part of the Symfony package. | ||
| * | ||
| * (c) Fabien Potencier <fabien@symfony.com> | ||
| * | ||
| * For the full copyright and license information, please view the LICENSE | ||
| * file that was distributed with this source code. | ||
| */ | ||
|
|
||
| namespace Symfony\Bundle\SecurityBundle\EventListener; | ||
|
|
||
| use Symfony\Component\EventDispatcher\EventSubscriberInterface; | ||
| use Symfony\Component\HttpKernel\Event\PostResponseEvent; | ||
| use Symfony\Component\HttpKernel\KernelEvents; | ||
| use Symfony\Component\Security\Http\Session\SessionRegistry; | ||
|
|
||
| /** | ||
| * Clear session information from registry for idle sessions | ||
| * | ||
| * @author Antonio J. García Lagar <aj@garcialagar.es> | ||
| */ | ||
| class SessionRegistryGarbageCollectorListener implements EventSubscriberInterface | ||
| { | ||
| /** | ||
| * @var SessionRegistry | ||
| */ | ||
| private $sessionRegistry; | ||
| private $maxLifetime; | ||
| private $probability; | ||
| private $divisor; | ||
|
|
||
| public function __construct(SessionRegistry $sessionRegistry, $maxLifetime = 1, $probability = null, $divisor = null) | ||
| { | ||
| $this->sessionRegistry = $sessionRegistry; | ||
| $this->maxLifetime = $maxLifetime ?: ini_get('session.gc_maxlifetime'); | ||
| $this->probability = $probability ?: ini_get('session.gc_probability'); | ||
| $this->divisor = $divisor ?: ini_get('session.gc_divisor'); | ||
| } | ||
|
|
||
| public function onKernelTerminate(PostResponseEvent $event) | ||
| { | ||
| if ($this->probability / $this->divisor > lcg_value() || true) { | ||
|
|
||
| $this->sessionRegistry->collectGarbage($this->maxLifetime); | ||
| } | ||
| } | ||
|
|
||
| public static function getSubscribedEvents() | ||
| { | ||
| return array( | ||
| KernelEvents::TERMINATE => array(array('onKernelTerminate')), | ||
| ); | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| <?xml version="1.0" encoding="UTF-8"?> | ||
|
|
||
| <container xmlns="http://symfony.com/schema/dic/services" | ||
| xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" | ||
| xsi:schemaLocation="http://symfony.com/schema/dic/services http://symfony.com/schema/dic/services/services-1.0.xsd"> | ||
|
|
||
| <parameters> | ||
| <parameter key="security.authentication.session_strategy.concurrent_control.class">Symfony\Component\Security\Http\Session\ConcurrentSessionControlAuthenticationStrategy</parameter> | ||
| <parameter key="security.authentication.session_strategy.register.class">Symfony\Component\Security\Http\Session\RegisterSessionAuthenticationStrategy</parameter> | ||
| <parameter key="security.authentication.session_strategy.composite.class">Symfony\Component\Security\Http\Session\CompositeSessionAuthenticationStrategy</parameter> | ||
| <parameter key="security.session_registry.class">Symfony\Component\Security\Http\Session\SessionRegistry</parameter> | ||
| <parameter key="security.session_registry.garbage_collector.class">Symfony\Bundle\SecurityBundle\EventListener\SessionRegistryGarbageCollectorListener</parameter> | ||
| <parameter key="security.session_registry.storage.file.class">Symfony\Component\Security\Http\Session\FileSessionRegistryStorage</parameter> | ||
| </parameters> | ||
|
|
||
| <services> | ||
|
|
||
| <service id="security.authentication.session_strategy.concurrent_control" class="%security.authentication.session_strategy.concurrent_control.class%" abstract="true" public="false"> | ||
| <argument type="service" id="security.session_registry" /> | ||
| <argument /> <!-- maximum sessions --> | ||
| <argument /> <!-- error if maximum exceeded --> | ||
| </service> | ||
|
|
||
| <service id="security.authentication.session_strategy.register" class="%security.authentication.session_strategy.register.class%" abstract="true" public="false"> | ||
| <argument type="service" id="security.session_registry" /> | ||
| </service> | ||
|
|
||
| <service id="security.authentication.session_strategy.composite" class="%security.authentication.session_strategy.composite.class%" abstract="true" public="false"> | ||
| <argument type="collection" /> <!-- delegate Strategies --> | ||
| </service> | ||
|
|
||
| <service id="security.session_registry" class="%security.session_registry.class%" public="true"> | ||
| <argument type="service" id="security.session_registry.storage" /> | ||
| </service> | ||
|
|
||
| <service id="security.session_registry.storage.file" class="%security.session_registry.storage.file.class%" public="false"> | ||
| <argument>%kernel.cache_dir%/session_registry</argument> | ||
| </service> | ||
|
|
||
| <service id="security.session_registry.garbage_collector" class="%security.session_registry.garbage_collector.class%" public="true"> | ||
| <tag name="kernel.event_subscriber" /> | ||
| <argument type="service" id="security.session_registry" /> | ||
| </service> | ||
|
|
||
| </services> | ||
| </container> |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,81 @@ | ||
| <?php | ||
|
|
||
| /* | ||
| * This file is part of the Symfony package. | ||
| * | ||
| * (c) Fabien Potencier <fabien@symfony.com> | ||
| * | ||
| * For the full copyright and license information, please view the LICENSE | ||
| * file that was distributed with this source code. | ||
| */ | ||
|
|
||
| namespace Symfony\Bundle\SecurityBundle\Tests\Functional; | ||
|
|
||
| /** | ||
| * @author Antonio J. García Lagar <aj@garcialagar.es> | ||
| * @group functional | ||
| */ | ||
| class SessionConcurrencyTest extends WebTestCase | ||
| { | ||
| public function testLoginWorksWhenConcurrentSessionsLesserThanMaximun() | ||
| { | ||
| $client = $this->createClient(array('test_case' => 'SessionExpiration', 'root_config' => 'session_concurrency.yml')); | ||
| $form = $client->request('GET', '/login')->selectButton('login')->form(); | ||
| $form['_username'] = 'antonio'; | ||
| $form['_password'] = 'secret'; | ||
| $client->submit($form); | ||
|
|
||
| $this->assertRedirect($client->getResponse(), '/profile'); | ||
| } | ||
|
|
||
| public function testLoginFailsWhenConcurrentSessionsGreaterOrEqualThanMaximun() | ||
| { | ||
| $client1 = $this->createClient(array('test_case' => 'SessionExpiration', 'root_config' => 'session_concurrency.yml')); | ||
| $client1->insulate(); | ||
| $form1 = $client1->request('GET', '/login')->selectButton('login')->form(); | ||
| $form1['_username'] = 'antonio'; | ||
| $form1['_password'] = 'secret'; | ||
| $client1->submit($form1); | ||
|
|
||
| $client2 = $this->createClient(array('test_case' => 'SessionExpiration', 'root_config' => 'session_concurrency.yml')); | ||
| $client2->insulate(); | ||
| $form2 = $client2->request('GET', '/login')->selectButton('login')->form(); | ||
| $form2['_username'] = 'antonio'; | ||
| $form2['_password'] = 'secret'; | ||
| $client2->submit($form2); | ||
|
|
||
| $this->assertRedirect($client2->getResponse(), '/login'); | ||
| } | ||
|
|
||
| public function testOldSessionExpiresConcurrentSessionsGreaterOrEqualThanMaximun() | ||
| { | ||
| $client1 = $this->createClient(array('test_case' => 'SessionExpiration', 'root_config' => 'session_concurrency_expiration.yml')); | ||
| $form1 = $client1->request('GET', '/login')->selectButton('login')->form(); | ||
| $form1['_username'] = 'antonio'; | ||
| $form1['_password'] = 'secret'; | ||
| $client1->submit($form1); | ||
| $this->assertRedirect($client1->getResponse(), '/profile'); | ||
|
|
||
| $client2 = $this->createClient(array('test_case' => 'SessionExpiration', 'root_config' => 'session_concurrency_expiration.yml')); | ||
| $client2->insulate(); | ||
| $form2 = $client2->request('GET', '/login')->selectButton('login')->form(); | ||
| $form2['_username'] = 'antonio'; | ||
| $form2['_password'] = 'secret'; | ||
| $client2->submit($form2); | ||
| $this->assertRedirect($client2->getResponse(), '/profile'); | ||
|
|
||
| $client1->request('GET', '/profile'); | ||
| $this->assertEquals(200, $client1->getResponse()->getStatusCode()); | ||
| $sessionRegistry = $client1->getContainer()->get('security.session_registry'); | ||
| $session1Infomation = $sessionRegistry->getSessionInformation($client1->getRequest()->getSession()->getId()); | ||
| sleep(1); //Waiting for the session to expire | ||
|
There was a problem hiding this comment. sleeps in tests are not funny. |
||
| $this->assertTrue($session1Infomation->isExpired()); | ||
| } | ||
|
|
||
| protected function tearDown() | ||
| { | ||
| parent::tearDown(); | ||
|
|
||
| $this->deleteTmpDir('SessionExpiration'); | ||
| } | ||
| } |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This does only belong to your other pull request, doesn't it?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes, this PR includes the other PR first two changesets.