Skip to content

Commit 60fcb92

Browse files
olavmo-siktolavmo-sikt
committed
session: New/unified cookie handling options.
Adds options to control the various session cookie parameters, and changes users of setcookie to use those options instead. git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2381 44740490-163a-0410-bde0-09ae8108e29a
1 parent 092e9a3 commit 60fcb92

6 files changed

Lines changed: 122 additions & 15 deletions

File tree

‎config-templates/config.php‎

Lines changed: 31 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -145,6 +145,36 @@
145145
'session.datastore.timeout' => (4*60*60), // 4 hours
146146

147147

148+
/*
149+
* Expiration time for the session cookie, in seconds.
150+
*
151+
* Defaults to 0, which means that the cookie expires when the browser is closed.
152+
*
153+
* Example:
154+
* 'session.cookie.lifetime' => 30*60,
155+
*/
156+
'session.cookie.lifetime' => 0,
157+
158+
/*
159+
* Limit the path of the cookies.
160+
*
161+
* Can be used to limit the path of the cookies to a specific subdirectory.
162+
*
163+
* Example:
164+
* 'session.cookie.path' => '/simplesaml/',
165+
*/
166+
'session.cookie.path' => '/',
167+
168+
/*
169+
* Cookie domain.
170+
*
171+
* Can be used to make the session cookie available to several domains.
172+
*
173+
* Example:
174+
* 'session.cookie.domain' => '.example.org',
175+
*/
176+
'session.cookie.domain' => NULL,
177+
148178
/*
149179
* Set the secure flag in the cookie.
150180
*
@@ -158,8 +188,8 @@
158188
* Options to override the default settings for php sessions.
159189
*/
160190
'session.phpsession.cookiename' => null,
161-
'session.phpsession.limitedpath' => false,
162191
'session.phpsession.savepath' => null,
192+
'session.phpsession.httponly' => FALSE,
163193

164194
/*
165195
* Languages available and what language is default

‎lib/SimpleSAML/AuthMemCookie.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -153,7 +153,8 @@ private function doLogout() {
153153
$memcache->delete($sessionID);
154154

155155
/* Delete the session cookie. */
156-
setcookie($cookieName, '', 1, '/', NULL, SimpleSAML_Utilities::isHTTPS(), TRUE);
156+
$sessionHandler = SimpleSAML_SessionHandler::getSessionHandler();
157+
$sessionHandler->setCookie($cookieName, NULL);
157158
}
158159

159160

‎lib/SimpleSAML/SessionHandler.php‎

Lines changed: 49 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -129,6 +129,53 @@ public function hasSessionCookie() {
129129
return TRUE;
130130
}
131131

132-
}
133132

134-
?>
133+
/**
134+
* Get the cookie parameters that should be used for session cookies.
135+
*
136+
* @return array
137+
* @link http://www.php.net/manual/en/function.session-get-cookie-params.php
138+
*/
139+
public function getCookieParams() {
140+
141+
$config = SimpleSAML_Configuration::getInstance();
142+
143+
return array(
144+
'lifetime' => $config->getInteger('session.cookie.lifetime', 0),
145+
'path' => $config->getString('session.cookie.path', '/'),
146+
'domain' => $config->getString('session.cookie.domain', NULL),
147+
'secure' => $config->getBoolean('session.cookie.secure', FALSE),
148+
'httponly' => TRUE,
149+
);
150+
}
151+
152+
153+
/**
154+
* Set a session cookie.
155+
*
156+
* @param string $name The name of the session cookie.
157+
* @param string|NULL $value The value of the cookie. Set to NULL to delete the cookie.
158+
*/
159+
public function setCookie($name, $value) {
160+
assert('is_string($name)');
161+
assert('is_string($value) || is_null($value)');
162+
163+
$params = $this->getCookieParams();
164+
165+
if ($value === NULL) {
166+
$expire = time() - 365*24*60*60;
167+
} elseif ($params['lifetime'] === 0) {
168+
$expire = 0;
169+
} else {
170+
$expire = time() + $params['lifetime'];;
171+
}
172+
173+
$version = explode('.', PHP_VERSION);
174+
if ((int)$version[0] === 5 && (int)$version[1] < 2) {
175+
setcookie($name, $value, $expire, $params['path'], $params['domain'], $params['secure']);
176+
} else {
177+
setcookie($name, $value, $expire, $params['path'], $params['domain'], $params['secure'], $params['httponly']);
178+
}
179+
}
180+
181+
}

‎lib/SimpleSAML/SessionHandlerCookie.php‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -51,9 +51,7 @@ protected function __construct() {
5151
/* We don't have a valid session. Create a new session id. */
5252
$this->session_id = self::createSessionID();
5353

54-
$config = SimpleSAML_Configuration::getInstance();
55-
$secureFlag = $config->getBoolean('session.cookie.secure', FALSE);
56-
setcookie('SimpleSAMLSessionID', $this->session_id, 0, '/', NULL, $secureFlag);
54+
$this->setCookie('SimpleSAMLSessionID', $this->session_id);
5755
}
5856

5957

‎lib/SimpleSAML/SessionHandlerPHP.php‎

Lines changed: 36 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -32,11 +32,16 @@ protected function __construct() {
3232
*/
3333
if(session_id() === '') {
3434
$config = SimpleSAML_Configuration::getInstance();
35-
36-
$cookiepath = ($config->getBoolean('session.phpsession.limitedpath', FALSE) ? '/' . $config->getBaseURL() : '/');
37-
$secureFlag = $config->getBoolean('session.cookie.secure', FALSE);
38-
session_set_cookie_params(0, $cookiepath, NULL, $secureFlag);
39-
35+
36+
$params = $this->getCookieParams();
37+
38+
$version = explode('.', PHP_VERSION);
39+
if ((int)$version[0] === 5 && (int)$version[1] < 2) {
40+
session_set_cookie_params($params['lifetime'], $params['path'], $params['domain'], $params['secure']);
41+
} else {
42+
session_set_cookie_params($params['lifetime'], $params['path'], $params['domain'], $params['secure'], $params['httponly']);
43+
}
44+
4045
$cookiename = $config->getString('session.phpsession.cookiename', NULL);
4146
if (!empty($cookiename)) session_name($cookiename);
4247

@@ -114,6 +119,30 @@ public function hasSessionCookie() {
114119
return array_key_exists($cookieName, $_COOKIE);
115120
}
116121

117-
}
118122

119-
?>
123+
/**
124+
* Get the cookie parameters that should be used for session cookies.
125+
*
126+
* This function contains some adjustments from the default to provide backwards-compatibility.
127+
*
128+
* @return array
129+
* @link http://www.php.net/manual/en/function.session-get-cookie-params.php
130+
*/
131+
public function getCookieParams() {
132+
133+
$config = SimpleSAML_Configuration::getInstance();
134+
135+
$ret = parent::getCookieParams();
136+
137+
if ($config->hasValue('session.phpsession.limitedpath') && $config->hasValue('session.cookie.path')) {
138+
throw new SimpleSAML_Error_Exception('You cannot set both the session.phpsession.limitedpath and session.cookie.path options.');
139+
} elseif ($config->hasValue('session.phpsession.limitedpath')) {
140+
$ret['path'] = $config->getBoolean('session.phpsession.limitedpath', FALSE) ? '/' . $config->getBaseURL() : '/';
141+
}
142+
143+
$ret['httponly'] = $config->getBoolean('session.phpsession.httponly', FALSE);
144+
145+
return $ret;
146+
}
147+
148+
}

‎www/authmemcookie.php‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,9 @@
6060
$sessionID = SimpleSAML_Utilities::generateID();
6161

6262
$cookieName = $amc->getCookieName();
63-
setcookie($cookieName, $sessionID, 0, '/', NULL, SimpleSAML_Utilities::isHTTPS(), TRUE);
63+
64+
$sessionHandler = SimpleSAML_SessionHandler::getSessionHandler();
65+
$sessionHandler->setCookie($cookieName, $sessionID);
6466

6567

6668
/* Generate the authentication information. */

0 commit comments

Comments
 (0)