Skip to content

Sessions to be used only in controllers and blocks #36

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Oct 26, 2018
Merged

Sessions to be used only in controllers and blocks #36

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
fd63ef1
Sessions to be used only in controllers and blocks
AlexMaxHorkun Oct 18, 2018
bf84e7f
Updated the doc
AlexMaxHorkun Oct 19, 2018
fa88d70
Allowing controller and block plugins
AlexMaxHorkun Oct 24, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions design-documents/sessions-only-for-html.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
### Magento\Framework\Session\SessionManagerInterface and Magento\Framework\Stdlib\Cookie\CookieReaderInterface should be used only in HTML related presentation level
#### Why?
Web APIs (REST (by definition), SOAP, GraphQL) do not employ sessions and cookies,
relying on sessions and cookies in classes that are not directly linked to preparing HTML
may cause sessions being used during Web API requests unintentionally causing
unexpected behaviour during and negative performance impact.

#### Current situation
Sessions and cookies are being used in model classes.

#### What has to be done
Add PHPMD rule which will be triggered when a class has a constructor parameter of type
SessionManagerInterface/CookieReaderInterface (and any of the implementations) and are not a part of HTML presentation level
(instances of ActionInterface, AbstractBlock, DataProviderInterface, Document, controller and block plugins).
The rule's message should explain that UserContextInterface should be used to get current
user instead of sessions and cookie usage should be avoided.

Removing all existing session and cookie usages from classes that are not a part of HTML presentation level would
prove to be a difficult process so we just have to warn developers not to use them
in the future with the PHPMD rule.