Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Sesssion Strategy should be on Token level? #29759

apodgorbunschih opened this issue Jan 3, 2019 · 1 comment


Copy link

@apodgorbunschih apodgorbunschih commented Jan 3, 2019

On the security level we can specify if the session should be migrated invalidate, or none.

   session_fixation_strategy: none | migrate | invalidate

The problem is that we can have multiple guards under 1 firewall.

                    - ..\Security\Authenticator\AAuthenticator
                    - ..\Security\Authenticator\BAuthenticator
                    - ..\Security\Authenticator\CAuthenticator

And each of this Authenticator creates a PostAuthenticationGuardToken. And in some case, AAuthenticator should invalidate the session. and the BAuthenticator should migrate the session. I would propose to move the session_strategy on the level of Authenticator, or maybe on Token level.

This is how I solved the problem in my case.

  1. I override the SessionAuthenticationStrategy
class TokenSessionStrategy extends SessionAuthenticationStrategy
     * @param Request $request
     * @param TokenInterface $token
    public function onAuthentication(Request $request, TokenInterface $token)
        $type = $token->getAttribute(PostAuthenticateToken::SESSION_AUTHENTICATION_STRATEGY_ATTRIBUTE);

  1. I extended the class PostAuthenticationGuardToken
class PostAuthenticateToken extends PostAuthenticationGuardToken
    const SESSION_AUTHENTICATION_STRATEGY_ATTRIBUTE = 'session_authentication_strategy';

    public function __construct(UserInterface $user, $providerKey, array $roles)
        parent::__construct($user, $providerKey, $roles);
        $this->setAttribute(self::SESSION_AUTHENTICATION_STRATEGY_ATTRIBUTE, SessionAuthenticationStrategy::INVALIDATE);

    public function keepSameSession()
        $this->setAttribute(self::SESSION_AUTHENTICATION_STRATEGY_ATTRIBUTE, SessionAuthenticationStrategy::NONE);

    public function migrateSession()
        $this->setAttribute(self::SESSION_AUTHENTICATION_STRATEGY_ATTRIBUTE, SessionAuthenticationStrategy::MIGRATE);

    public function invalidateSession()
        $this->setAttribute(self::SESSION_AUTHENTICATION_STRATEGY_ATTRIBUTE, SessionAuthenticationStrategy::INVALIDATE);

Does it make sense to do this change on token level, if yes i can try to come with a PR .


@apodgorbunschih apodgorbunschih changed the title Sesssion Strategy should be on Token level. Sesssion Strategy should be on Token level? Jan 3, 2019

This comment has been minimized.

Copy link
Contributor Author

@apodgorbunschih apodgorbunschih commented Jan 18, 2019

@weaverryan Hi Ryan, do you think this makes sense?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
None yet
2 participants
You can’t perform that action at this time.