Skip to content

Secure and Lazy session changes #8716

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Nov 27, 2017
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions _build/redirection_map
Original file line number Diff line number Diff line change
Expand Up @@ -194,7 +194,7 @@
/cookbook/psr7 /components/psr7
/cookbook/request/index /request
/cookbook/request/load_balancer_reverse_proxy /deployment/proxies
/cookbook/request/mime_type /reference/configuration/framework#formats
/cookbook/request/mime_type /reference/configuration/framework
/cookbook/routing/conditions /routing/conditions
/cookbook/routing/custom_route_loader /routing/custom_route_loader
/cookbook/routing/debug /routing/debug
Expand Down Expand Up @@ -244,7 +244,8 @@
/cookbook/service_container/shared /service_container/shared
/cookbook/session/avoid_session_start /session/avoid_session_start
/cookbook/session/index /session
/cookbook/session/limit_metadata_writes /session/limit_metadata_writes
/cookbook/session/limit_metadata_writes /reference/configuration/framework
/session/limit_metadata_writes /reference/configuration/framework
/cookbook/session/locale_sticky_session /session/locale_sticky_session
/cookbook/session/php_bridge /session/php_bridge
/cookbook/session/proxy_examples /session/proxy_examples
Expand Down
25 changes: 7 additions & 18 deletions reference/configuration/framework.rst
Original file line number Diff line number Diff line change
Expand Up @@ -70,7 +70,6 @@ Configuration
* `gc_divisor`_
* `gc_probability`_
* `gc_maxlifetime`_
* `use_strict_mode`_
* `save_path`_
* `metadata_update_threshold`_
* `assets`_
Expand Down Expand Up @@ -845,17 +844,6 @@ This determines the number of seconds after which data will be seen as "garbage"
and potentially cleaned up. Garbage collection may occur during session
start and depends on `gc_divisor`_ and `gc_probability`_.

use_strict_mode
...............

**type**: ``boolean`` **default**: ``false``

This specifies whether the session module will use the strict session id mode.
If this mode is enabled, the module does not accept uninitialized session IDs.
If an uninitialized session ID is sent from browser, a new session ID is sent
to browser. Applications are protected from session fixation via session
adoption with strict mode.

save_path
.........

Expand Down Expand Up @@ -902,18 +890,19 @@ setting the value to ``null``:
),
));

.. _reference-session-metadata-update-threshold:

metadata_update_threshold
.........................

**type**: ``integer`` **default**: ``0``

This is how many seconds to wait between two session metadata updates. It will
also prevent the session handler to write if the session has not changed.

.. seealso::
This is how many seconds to wait between updating/writing the session metadata. This
can be useful if, for some reason, you want to limit the frequency at which the
session persists.

You can see an example of the usage of this in
:doc:`/session/limit_metadata_writes`.
Starting in Symfony 3.4, session data is *only* written when the session data has
changed. Previously, you needed to set this option to avoid that behavior.

assets
~~~~~~
Expand Down
66 changes: 0 additions & 66 deletions session/limit_metadata_writes.rst

This file was deleted.