SessionHandlerCookie.php

Go to the documentation of this file.

<?php
 
 
namespace SimpleSAML;
 
use SimpleSAML\Utils\HTTP;
 
abstract class SessionHandlerCookie extends SessionHandler
{
 
    private $session_id = null;
 
 
    protected $cookie_name;
 
 
    protected function __construct()
    {
        // call the constructor in the base class in case it should become necessary in the future
        parent::__construct();
 
        $config = \SimpleSAML_Configuration::getInstance();
        $this->cookie_name = $config->getString('session.cookie.name', 'SimpleSAMLSessionID');
    }
 
 
    public function newSessionId()
    {
        $this->session_id = self::createSessionID();
        \SimpleSAML_Session::createSession($this->session_id);
 
        return $this->session_id;
    }
 
 
    public function getCookieSessionId()
    {
        if ($this->session_id === null) {
            if (self::hasSessionCookie()) {
                // attempt to retrieve the session id from the cookie
                $this->session_id = $_COOKIE[$this->cookie_name];
            }
 
            // check if we have a valid session id
            if (!self::isValidSessionID($this->session_id)) {
                // invalid, disregard this session
                return null;
            }
        }
 
        return $this->session_id;
    }
 
 
    public function getSessionCookieName()
    {
        return $this->cookie_name;
    }
 
 
    private static function createSessionID()
    {
        return bin2hex(openssl_random_pseudo_bytes(16));
    }
 
 
    private static function isValidSessionID($session_id)
    {
        if (!is_string($session_id)) {
            return false;
        }
 
        if (strlen($session_id) != 32) {
            return false;
        }
 
        if (preg_match('/[^0-9a-f]/', $session_id)) {
            return false;
        }
 
        return true;
    }
 
 
    public function hasSessionCookie()
    {
        return array_key_exists($this->cookie_name, $_COOKIE);
    }
 
 
    public function setCookie($sessionName, $sessionID, array $cookieParams = null)
    {
        assert(is_string($sessionName));
        assert(is_string($sessionID) || $sessionID === null);
 
        if ($cookieParams !== null) {
            $params = array_merge($this->getCookieParams(), $cookieParams);
        } else {
            $params = $this->getCookieParams();
        }
 
        HTTP::setCookie($sessionName, $sessionID, $params, true);
    }
}