SessionService uses BlockSerializationTrait

Secure session handling for the install tool.

Internal

This class is only meant to be used within EXT:install and is not part of the TYPO3 Core API.

Table of Contents

Properties

$lateBootService  : LateBootService
$logger  : LoggerInterface

Methods

__construct()  : mixed
__wakeup()  : mixed
Deny object deserialization.
addMessage()  : mixed
Add a message to "Flash" message storage.
destroySession()  : void
Destroys a session
getBackendUserSession()  : array{userId: int, nonce: string, hmac: string}
getMessagesAndFlush()  : FlashMessage[]
Return stored session messages and flush.
hasActiveBackendUserRoleAndSession()  : bool
Evaluates whether the backend user that initiated this admin tool session, has an active role (is still admin & system maintainer) and has an active backend user interface session.
hasSessionCookie()  : bool
Checks whether is session cookie is set
initializeSession()  : mixed
installSessionHandler()  : void
isAuthorized()  : bool
Check if we have an already authorized session
isAuthorizedBackendUserSession()  : bool
Check if we have an authorized session from a system maintainer
isExpired()  : bool
Check if our session is expired.
refreshSession()  : mixed
Refreshes our session information, rising the expire time.
resetSession()  : mixed
Reset session. Sets _SESSION to empty array.
setAuthorized()  : mixed
Marks this session as an "authorized" one (login successful).
setAuthorizedBackendSession()  : mixed
Marks this session as an "authorized by backend user" one.
startSession()  : string|false
Starts a new session
getBackendUserRecord()  : array<string, int>|null
Fetching a user record with uid=$uid.
getDefaultSessionHandler()  : SessionHandlerInterface
getIniValueBoolean()  : bool
Cast an on/off php ini value to boolean
isSessionAutoStartEnabled()  : bool
Check if php session.auto_start is enabled
logInsecureSessionCookieSettings()  : void
Most of the session settings above are best practice, and the install tool keeps working without them. These two are not: They keep the session cookie from being sent over plain HTTP and from being readable by JavaScript.

Properties

$logger read-only

protected LoggerInterface $logger

Methods

__wakeup()

Deny object deserialization.

public __wakeup() : mixed

destroySession()

Destroys a session

public destroySession(ServerRequestInterface|null $request) : void
Parameters
$request : ServerRequestInterface|null

getBackendUserSession()

public getBackendUserSession() : array{userId: int, nonce: string, hmac: string}
Return values
array{userId: int, nonce: string, hmac: string} —

backend user session references

hasActiveBackendUserRoleAndSession()

Evaluates whether the backend user that initiated this admin tool session, has an active role (is still admin & system maintainer) and has an active backend user interface session.

public hasActiveBackendUserRoleAndSession() : bool
Return values
bool —

whether the backend user has an active role and backend user interface session

hasSessionCookie()

Checks whether is session cookie is set

public hasSessionCookie(ServerRequestInterface $request) : bool
Parameters
$request : ServerRequestInterface
Return values
bool

initializeSession()

public initializeSession() : mixed

installSessionHandler()

public installSessionHandler(ServerRequestInterface|null $request) : void
Parameters
$request : ServerRequestInterface|null

isAuthorized()

Check if we have an already authorized session

public isAuthorized(ServerRequestInterface $request) : bool
Parameters
$request : ServerRequestInterface
Return values
bool —

TRUE if this session has been authorized before (by a correct password)

isAuthorizedBackendUserSession()

Check if we have an authorized session from a system maintainer

public isAuthorizedBackendUserSession(ServerRequestInterface $request) : bool
Parameters
$request : ServerRequestInterface
Return values
bool —

TRUE if this session has been authorized before and initialized by a backend system maintainer

isExpired()

Check if our session is expired.

public isExpired(ServerRequestInterface $request) : bool

Useful only right after a FALSE "isAuthorized" to see if this is the reason for not being authorized anymore.

Parameters
$request : ServerRequestInterface
Return values
bool —

TRUE if an authorized session exists, but is expired

refreshSession()

Refreshes our session information, rising the expire time.

public refreshSession() : mixed

Also generates a new session ID every 5 minutes to minimize the risk of session hijacking.

resetSession()

Reset session. Sets _SESSION to empty array.

public resetSession() : mixed

setAuthorized()

Marks this session as an "authorized" one (login successful).

public setAuthorized() : mixed

Should only be called if: a) we have a valid session running b) the "password" or some other authorization mechanism really matched

startSession()

Starts a new session

public startSession() : string|false
Return values
string|false —

The session ID

getBackendUserRecord()

Fetching a user record with uid=$uid.

protected getBackendUserRecord(ContainerInterface $container, int $uid) : array<string, int>|null

Functionally similar to TYPO3\CMS\Core\Authentication\BackendUserAuthentication::setBeUserByUid().

Parameters
$container : ContainerInterface
$uid : int

The UID of the backend user

Return values
array<string, int>|null —

The backend user record or NULL

getDefaultSessionHandler()

protected getDefaultSessionHandler() : SessionHandlerInterface
Return values
SessionHandlerInterface

getIniValueBoolean()

Cast an on/off php ini value to boolean

protected getIniValueBoolean(string $configOption) : bool
Parameters
$configOption : string
Return values
bool —

TRUE if the given option is enabled, FALSE if disabled

isSessionAutoStartEnabled()

Check if php session.auto_start is enabled

protected isSessionAutoStartEnabled() : bool
Return values
bool —

TRUE if session.auto_start is enabled, FALSE if disabled

logInsecureSessionCookieSettings()

Most of the session settings above are best practice, and the install tool keeps working without them. These two are not: They keep the session cookie from being sent over plain HTTP and from being readable by JavaScript.

protected logInsecureSessionCookieSettings(bool $https) : void

"ini_set" does not necessarily apply them. It returns false without any error if an option can not be changed at runtime, and throws if the function is disabled altogether, so the values are read back rather than relying on the calls having had an effect.

Parameters
$https : bool
On this page

Search results