3 * MediaWiki session provider base class
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation; either version 2 of the License, or
8 * (at your option) any later version.
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
15 * You should have received a copy of the GNU General Public License along
16 * with this program; if not, write to the Free Software Foundation, Inc.,
17 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
18 * http://www.gnu.org/copyleft/gpl.html
24 namespace MediaWiki\Session
;
29 * An ImmutableSessionProviderWithCookie doesn't persist the user, but
30 * optionally can use a cookie to support multiple IDs per session.
32 * As mentioned in the documentation for SessionProvider, many methods that are
33 * technically "cannot persist ID" could be turned into "can persist ID but
34 * not changing User" using a session cookie. This class implements such an
35 * optional session cookie.
40 abstract class ImmutableSessionProviderWithCookie
extends SessionProvider
{
42 /** @var string|null */
43 protected $sessionCookieName = null;
45 protected $sessionCookieOptions = [];
48 * @param array $params Keys include:
49 * - sessionCookieName: Session cookie name, if multiple sessions per
50 * client are to be supported.
51 * - sessionCookieOptions: Options to pass to WebResponse::setCookie().
53 public function __construct( $params = [] ) {
54 parent
::__construct();
56 if ( isset( $params['sessionCookieName'] ) ) {
57 if ( !is_string( $params['sessionCookieName'] ) ) {
58 throw new \
InvalidArgumentException( 'sessionCookieName must be a string' );
60 $this->sessionCookieName
= $params['sessionCookieName'];
62 if ( isset( $params['sessionCookieOptions'] ) ) {
63 if ( !is_array( $params['sessionCookieOptions'] ) ) {
64 throw new \
InvalidArgumentException( 'sessionCookieOptions must be an array' );
66 $this->sessionCookieOptions
= $params['sessionCookieOptions'];
71 * Get the session ID from the cookie, if any.
73 * Only call this if $this->sessionCookieName !== null. If
74 * sessionCookieName is null, do some logic (probably involving a call to
75 * $this->hashToSessionId()) to create the single session ID corresponding
76 * to this WebRequest instead of calling this method.
78 * @param WebRequest $request
81 protected function getSessionIdFromCookie( WebRequest
$request ) {
82 if ( $this->sessionCookieName
=== null ) {
83 throw new \
BadMethodCallException(
84 __METHOD__
. ' may not be called when $this->sessionCookieName === null'
88 $prefix = $this->sessionCookieOptions
['prefix'] ??
$this->config
->get( 'CookiePrefix' );
89 $id = $request->getCookie( $this->sessionCookieName
, $prefix );
90 return SessionManager
::validateSessionId( $id ) ?
$id : null;
93 public function persistsSessionId() {
94 return $this->sessionCookieName
!== null;
97 public function canChangeUser() {
101 public function persistSession( SessionBackend
$session, WebRequest
$request ) {
102 if ( $this->sessionCookieName
=== null ) {
106 $response = $request->response();
107 if ( $response->headersSent() ) {
108 // Can't do anything now
109 $this->logger
->debug( __METHOD__
. ': Headers already sent' );
113 $options = $this->sessionCookieOptions
;
114 if ( $session->shouldForceHTTPS() ||
$session->getUser()->requiresHTTPS() ) {
115 $response->setCookie( 'forceHTTPS', 'true', null,
116 [ 'prefix' => '', 'secure' => false ] +
$options );
117 $options['secure'] = true;
120 $response->setCookie( $this->sessionCookieName
, $session->getId(), null, $options );
123 public function unpersistSession( WebRequest
$request ) {
124 if ( $this->sessionCookieName
=== null ) {
128 $response = $request->response();
129 if ( $response->headersSent() ) {
130 // Can't do anything now
131 $this->logger
->debug( __METHOD__
. ': Headers already sent' );
135 $response->clearCookie( $this->sessionCookieName
, $this->sessionCookieOptions
);
138 public function getVaryCookies() {
139 if ( $this->sessionCookieName
=== null ) {
143 $prefix = $this->sessionCookieOptions
['prefix'] ??
$this->config
->get( 'CookiePrefix' );
144 return [ $prefix . $this->sessionCookieName
];
147 public function whyNoSession() {
148 return wfMessage( 'sessionprovider-nocookies' );