SessionHandlerCookie.php

Go to the documentation of this file.

<?php


namespace SimpleSAML;

use SimpleSAML\Utils\HTTP;

abstract class SessionHandlerCookie extends SessionHandler
{

    private $session_id = null;


    protected $cookie_name;


    protected function __construct()
    {
        // call the constructor in the base class in case it should become necessary in the future
        parent::__construct();

        $config = \SimpleSAML_Configuration::getInstance();
        $this->cookie_name = $config->getString('session.cookie.name', 'SimpleSAMLSessionID');
    }


    public function newSessionId()
    {
        $this->session_id = self::createSessionID();
        \SimpleSAML_Session::createSession($this->session_id);

        return $this->session_id;
    }


    public function getCookieSessionId()
    {
        if ($this->session_id === null) {
            if (self::hasSessionCookie()) {
                // attempt to retrieve the session id from the cookie
                $this->session_id = $_COOKIE[$this->cookie_name];
            }

            // check if we have a valid session id
            if (!self::isValidSessionID($this->session_id)) {
                // invalid, disregard this session
                return null;
            }
        }

        return $this->session_id;
    }


    public function getSessionCookieName()
    {
        return $this->cookie_name;
    }


    private static function createSessionID()
    {
        return bin2hex(openssl_random_pseudo_bytes(16));
    }


    private static function isValidSessionID($session_id)
    {
        if (!is_string($session_id)) {
            return false;
        }

        if (strlen($session_id) != 32) {
            return false;
        }

        if (preg_match('/[^0-9a-f]/', $session_id)) {
            return false;
        }

        return true;
    }


    public function hasSessionCookie()
    {
        return array_key_exists($this->cookie_name, $_COOKIE);
    }


    public function setCookie($sessionName, $sessionID, array $cookieParams = null)
    {
        assert(is_string($sessionName));
        assert(is_string($sessionID) || $sessionID === null);

        if ($cookieParams !== null) {
            $params = array_merge($this->getCookieParams(), $cookieParams);
        } else {
            $params = $this->getCookieParams();
        }

        HTTP::setCookie($sessionName, $sessionID, $params, true);
    }
}