3 * MediaWiki cookie-based session provider interface
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation; either version 2 of the License, or
8 * (at your option) any later version.
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
15 * You should have received a copy of the GNU General Public License along
16 * with this program; if not, write to the Free Software Foundation, Inc.,
17 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
18 * http://www.gnu.org/copyleft/gpl.html
24 namespace MediaWiki\Session
;
31 * A CookieSessionProvider persists sessions using cookies
36 class CookieSessionProvider
extends SessionProvider
{
39 protected $params = [];
42 protected $cookieOptions = [];
45 * @param array $params Keys include:
46 * - priority: (required) Priority of the returned sessions
47 * - callUserSetCookiesHook: Whether to call the deprecated hook
48 * - sessionName: Session cookie name. Doesn't honor 'prefix'. Defaults to
49 * $wgSessionName, or $wgCookiePrefix . '_session' if that is unset.
50 * - cookieOptions: Options to pass to WebRequest::setCookie():
51 * - prefix: Cookie prefix, defaults to $wgCookiePrefix
52 * - path: Cookie path, defaults to $wgCookiePath
53 * - domain: Cookie domain, defaults to $wgCookieDomain
54 * - secure: Cookie secure flag, defaults to $wgCookieSecure
55 * - httpOnly: Cookie httpOnly flag, defaults to $wgCookieHttpOnly
57 public function __construct( $params = [] ) {
58 parent
::__construct();
61 'cookieOptions' => [],
62 // @codeCoverageIgnoreStart
64 // @codeCoverageIgnoreEnd
66 if ( !isset( $params['priority'] ) ) {
67 throw new \
InvalidArgumentException( __METHOD__
. ': priority must be specified' );
69 if ( $params['priority'] < SessionInfo
::MIN_PRIORITY ||
70 $params['priority'] > SessionInfo
::MAX_PRIORITY
72 throw new \
InvalidArgumentException( __METHOD__
. ': Invalid priority' );
75 if ( !is_array( $params['cookieOptions'] ) ) {
76 throw new \
InvalidArgumentException( __METHOD__
. ': cookieOptions must be an array' );
79 $this->priority
= $params['priority'];
80 $this->cookieOptions
= $params['cookieOptions'];
81 $this->params
= $params;
82 unset( $this->params
['priority'] );
83 unset( $this->params
['cookieOptions'] );
86 public function setConfig( Config
$config ) {
87 parent
::setConfig( $config );
89 // @codeCoverageIgnoreStart
91 // @codeCoverageIgnoreEnd
92 'callUserSetCookiesHook' => false,
94 $config->get( 'SessionName' ) ?
: $config->get( 'CookiePrefix' ) . '_session',
97 // @codeCoverageIgnoreStart
98 $this->cookieOptions +
= [
99 // @codeCoverageIgnoreEnd
100 'prefix' => $config->get( 'CookiePrefix' ),
101 'path' => $config->get( 'CookiePath' ),
102 'domain' => $config->get( 'CookieDomain' ),
103 'secure' => $config->get( 'CookieSecure' ),
104 'httpOnly' => $config->get( 'CookieHttpOnly' ),
108 public function provideSessionInfo( WebRequest
$request ) {
109 $sessionId = $this->getCookie( $request, $this->params
['sessionName'], '' );
112 'forceHTTPS' => $this->getCookie( $request, 'forceHTTPS', '', false )
114 if ( SessionManager
::validateSessionId( $sessionId ) ) {
115 $info['id'] = $sessionId;
116 $info['persisted'] = true;
119 list( $userId, $userName, $token ) = $this->getUserInfoFromCookies( $request );
120 if ( $userId !== null ) {
122 $userInfo = UserInfo
::newFromId( $userId );
123 } catch ( \InvalidArgumentException
$ex ) {
128 if ( $userName !== null && $userInfo->getName() !== $userName ) {
129 $this->logger
->warning(
130 'Session "{session}" requested with mismatched UserID and UserName cookies.',
132 'session' => $sessionId,
135 'cookie_username' => $userName,
136 'username' => $userInfo->getName(),
142 if ( $token !== null ) {
143 if ( !hash_equals( $userInfo->getToken(), $token ) ) {
144 $this->logger
->warning(
145 'Session "{session}" requested with invalid Token cookie.',
147 'session' => $sessionId,
149 'username' => $userInfo->getName(),
153 $info['userInfo'] = $userInfo->verified();
154 $info['persisted'] = true; // If we have user+token, it should be
155 } elseif ( isset( $info['id'] ) ) {
156 $info['userInfo'] = $userInfo;
158 // No point in returning, loadSessionInfoFromStore() will
162 } elseif ( isset( $info['id'] ) ) {
163 // No UserID cookie, so insist that the session is anonymous.
164 // Note: this event occurs for several normal activities:
165 // * anon visits Special:UserLogin
166 // * anon browsing after seeing Special:UserLogin
167 // * anon browsing after edit or preview
168 $this->logger
->debug(
169 'Session "{session}" requested without UserID cookie',
171 'session' => $info['id'],
173 $info['userInfo'] = UserInfo
::newAnonymous();
175 // No session ID and no user is the same as an empty session, so
180 return new SessionInfo( $this->priority
, $info );
183 public function persistsSessionId() {
187 public function canChangeUser() {
191 public function persistSession( SessionBackend
$session, WebRequest
$request ) {
192 $response = $request->response();
193 if ( $response->headersSent() ) {
194 // Can't do anything now
195 $this->logger
->debug( __METHOD__
. ': Headers already sent' );
199 $user = $session->getUser();
201 $cookies = $this->cookieDataToExport( $user, $session->shouldRememberUser() );
202 $sessionData = $this->sessionDataToExport( $user );
205 if ( $this->params
['callUserSetCookiesHook'] && !$user->isAnon() ) {
206 \Hooks
::run( 'UserSetCookies', [ $user, &$sessionData, &$cookies ] );
209 $options = $this->cookieOptions
;
211 $forceHTTPS = $session->shouldForceHTTPS() ||
$user->requiresHTTPS();
213 // Don't set the secure flag if the request came in
214 // over "http", for backwards compat.
215 // @todo Break that backwards compat properly.
216 $options['secure'] = $this->config
->get( 'CookieSecure' );
219 $response->setCookie( $this->params
['sessionName'], $session->getId(), null,
220 [ 'prefix' => '' ] +
$options
223 foreach ( $cookies as $key => $value ) {
224 if ( $value === false ) {
225 $response->clearCookie( $key, $options );
227 $expirationDuration = $this->getLoginCookieExpiration( $key, $session->shouldRememberUser() );
228 $expiration = $expirationDuration ?
$expirationDuration +
time() : null;
229 $response->setCookie( $key, (string)$value, $expiration, $options );
233 $this->setForceHTTPSCookie( $forceHTTPS, $session, $request );
234 $this->setLoggedOutCookie( $session->getLoggedOutTimestamp(), $request );
236 if ( $sessionData ) {
237 $session->addData( $sessionData );
241 public function unpersistSession( WebRequest
$request ) {
242 $response = $request->response();
243 if ( $response->headersSent() ) {
244 // Can't do anything now
245 $this->logger
->debug( __METHOD__
. ': Headers already sent' );
254 $response->clearCookie(
255 $this->params
['sessionName'], [ 'prefix' => '' ] +
$this->cookieOptions
258 foreach ( $cookies as $key => $value ) {
259 $response->clearCookie( $key, $this->cookieOptions
);
262 $this->setForceHTTPSCookie( false, null, $request );
266 * Set the "forceHTTPS" cookie
267 * @param bool $set Whether the cookie should be set or not
268 * @param SessionBackend|null $backend
269 * @param WebRequest $request
271 protected function setForceHTTPSCookie(
272 $set, SessionBackend
$backend = null, WebRequest
$request
274 $response = $request->response();
276 if ( $backend->shouldRememberUser() ) {
277 $expirationDuration = $this->getLoginCookieExpiration(
281 $expiration = $expirationDuration ?
$expirationDuration +
time() : null;
285 $response->setCookie( 'forceHTTPS', 'true', $expiration,
286 [ 'prefix' => '', 'secure' => false ] +
$this->cookieOptions
);
288 $response->clearCookie( 'forceHTTPS',
289 [ 'prefix' => '', 'secure' => false ] +
$this->cookieOptions
);
294 * Set the "logged out" cookie
295 * @param int $loggedOut timestamp
296 * @param WebRequest $request
298 protected function setLoggedOutCookie( $loggedOut, WebRequest
$request ) {
299 if ( $loggedOut +
86400 > time() &&
300 $loggedOut !== (int)$this->getCookie( $request, 'LoggedOut', $this->cookieOptions
['prefix'] )
302 $request->response()->setCookie( 'LoggedOut', $loggedOut, $loggedOut +
86400,
303 $this->cookieOptions
);
307 public function getVaryCookies() {
309 // Vary on token and session because those are the real authn
310 // determiners. UserID and UserName don't matter without those.
311 $this->cookieOptions
['prefix'] . 'Token',
312 $this->cookieOptions
['prefix'] . 'LoggedOut',
313 $this->params
['sessionName'],
318 public function suggestLoginUsername( WebRequest
$request ) {
319 $name = $this->getCookie( $request, 'UserName', $this->cookieOptions
['prefix'] );
320 if ( $name !== null ) {
321 $name = User
::getCanonicalName( $name, 'usable' );
323 return $name === false ?
null : $name;
327 * Fetch the user identity from cookies
328 * @param \WebRequest $request
329 * @return array (string|null $id, string|null $username, string|null $token)
331 protected function getUserInfoFromCookies( $request ) {
332 $prefix = $this->cookieOptions
['prefix'];
334 $this->getCookie( $request, 'UserID', $prefix ),
335 $this->getCookie( $request, 'UserName', $prefix ),
336 $this->getCookie( $request, 'Token', $prefix ),
341 * Get a cookie. Contains an auth-specific hack.
342 * @param \WebRequest $request
344 * @param string $prefix
345 * @param mixed|null $default
348 protected function getCookie( $request, $key, $prefix, $default = null ) {
349 $value = $request->getCookie( $key, $prefix, $default );
350 if ( $value === 'deleted' ) {
351 // PHP uses this value when deleting cookies. A legitimate cookie will never have
352 // this value (usernames start with uppercase, token is longer, other auth cookies
353 // are booleans or integers). Seeing this means that in a previous request we told the
354 // client to delete the cookie, but it has poor cookie handling. Pretend the cookie is
355 // not there to avoid invalidating the session.
362 * Return the data to store in cookies
364 * @param bool $remember
365 * @return array $cookies Set value false to unset the cookie
367 protected function cookieDataToExport( $user, $remember ) {
368 if ( $user->isAnon() ) {
375 'UserID' => $user->getId(),
376 'UserName' => $user->getName(),
377 'Token' => $remember ?
(string)$user->getToken() : false,
383 * Return extra data to store in the session
385 * @return array $session
387 protected function sessionDataToExport( $user ) {
388 // If we're calling the legacy hook, we should populate $session
389 // like User::setCookies() did.
390 if ( !$user->isAnon() && $this->params
['callUserSetCookiesHook'] ) {
392 'wsUserID' => $user->getId(),
393 'wsToken' => $user->getToken(),
394 'wsUserName' => $user->getName(),
401 public function whyNoSession() {
402 return wfMessage( 'sessionprovider-nocookies' );
405 public function getRememberUserDuration() {
406 return min( $this->getLoginCookieExpiration( 'UserID', true ),
407 $this->getLoginCookieExpiration( 'Token', true ) ) ?
: null;
411 * Gets the list of cookies that must be set to the 'remember me' duration,
412 * if $wgExtendedLoginCookieExpiration is in use.
414 * @return string[] Array of unprefixed cookie keys
416 protected function getExtendedLoginCookies() {
417 return [ 'UserID', 'UserName', 'Token' ];
421 * Returns the lifespan of the login cookies, in seconds. 0 means until the end of the session.
423 * Cookies that are session-length do not call this function.
425 * @param string $cookieName
426 * @param bool $shouldRememberUser Whether the user should be remembered
428 * @return int Cookie expiration time in seconds; 0 for session cookies
430 protected function getLoginCookieExpiration( $cookieName, $shouldRememberUser ) {
431 $extendedCookies = $this->getExtendedLoginCookies();
432 $normalExpiration = $this->config
->get( 'CookieExpiration' );
434 if ( $shouldRememberUser && in_array( $cookieName, $extendedCookies, true ) ) {
435 $extendedExpiration = $this->config
->get( 'ExtendedLoginCookieExpiration' );
437 return ( $extendedExpiration !== null ) ?
(int)$extendedExpiration : (int)$normalExpiration;
439 return (int)$normalExpiration;