Sesssion Strategy should be on Token level?

[apodgorbunschih]

On the security level we can specify if the session should be migrated invalidate, or none.

security:
   session_fixation_strategy: none | migrate | invalidate

The problem is that we can have multiple guards under 1 firewall.

      ...
            guard:
                authenticators:
                    - ..\Security\Authenticator\AAuthenticator
                    - ..\Security\Authenticator\BAuthenticator
                    - ..\Security\Authenticator\CAuthenticator

And each of this Authenticator creates a PostAuthenticationGuardToken. And in some case, AAuthenticator should invalidate the session. and the BAuthenticator should migrate the session. I would propose to move the session_strategy on the level of Authenticator, or maybe on Token level.

This is how I solved the problem in my case.

1. I override the SessionAuthenticationStrategy

class TokenSessionStrategy extends SessionAuthenticationStrategy
{
    /**.
     * @param Request $request
     * @param TokenInterface $token
     */
    public function onAuthentication(Request $request, TokenInterface $token)
    {
        $type = $token->getAttribute(PostAuthenticateToken::SESSION_AUTHENTICATION_STRATEGY_ATTRIBUTE);

...
    }

2. I extended the class PostAuthenticationGuardToken

class PostAuthenticateToken extends PostAuthenticationGuardToken
{
    const SESSION_AUTHENTICATION_STRATEGY_ATTRIBUTE = 'session_authentication_strategy';

    public function __construct(UserInterface $user, $providerKey, array $roles)
    {
        parent::__construct($user, $providerKey, $roles);
        $this->setAttribute(self::SESSION_AUTHENTICATION_STRATEGY_ATTRIBUTE, SessionAuthenticationStrategy::INVALIDATE);
    }

    public function keepSameSession()
    {
        $this->setAttribute(self::SESSION_AUTHENTICATION_STRATEGY_ATTRIBUTE, SessionAuthenticationStrategy::NONE);
    }

    public function migrateSession()
    {
        $this->setAttribute(self::SESSION_AUTHENTICATION_STRATEGY_ATTRIBUTE, SessionAuthenticationStrategy::MIGRATE);
    }

    public function invalidateSession()
    {
        $this->setAttribute(self::SESSION_AUTHENTICATION_STRATEGY_ATTRIBUTE, SessionAuthenticationStrategy::INVALIDATE);
    }
}

Does it make sense to do this change on token level, if yes i can try to come with a PR .

Regards.

[apodgorbunschih]

@weaverryan Hi Ryan, do you think this makes sense?