[Security] Facilitate the management of user sessions #52412
Closed
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Storing user sessions in databases, such as MariaDB, MySQL or PosgreSQL, is not that easy.
When reading the documentation page for the Sessions management, it appears the DB structure is quite rigid. In addition, the developers who use Doctrine and Doctrine Migrations will feel frustrated as there are some actions to be done by hand: the DB structure is not related to any entity.
Relationships between the user and the current session is not that easy as well.
In addition, the bullet "Simultaneous session limiting (e.g. each user can login only from one device at the same time)" mentioned in #30914 is hard to achieve.
In one project, session mgmt is a strong requirement and finally I used a custom handler and entities/repositories to achieve this very simply. I think it could be a good idea to integrate it directly in Symfony so that anybody could use it.
The feature implementation is much simpler:
UserSessionInterface
: represents the user session and the relationship with the user objectUserSessionRepositoryInterface
: manages the UserSession objectsUserSessionHandler
: it extendsAbstractSessionHandler
and uses the repository for the sessions lifecycleThis is a very simple proposal at the moment. Namespace and concept to be discussed.
Example of concrete classes below.