3 * MediaWiki cookie-based session provider interface
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation; either version 2 of the License, or
8 * (at your option) any later version.
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
15 * You should have received a copy of the GNU General Public License along
16 * with this program; if not, write to the Free Software Foundation, Inc.,
17 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
18 * http://www.gnu.org/copyleft/gpl.html
24 namespace MediaWiki\Session
;
31 * A CookieSessionProvider persists sessions using cookies
36 class CookieSessionProvider
extends SessionProvider
{
38 protected $params = array();
39 protected $cookieOptions = array();
42 * @param array $params Keys include:
43 * - priority: (required) Priority of the returned sessions
44 * - callUserSetCookiesHook: Whether to call the deprecated hook
45 * - sessionName: Session cookie name. Doesn't honor 'prefix'. Defaults to
46 * $wgSessionName, or $wgCookiePrefix . '_session' if that is unset.
47 * - cookieOptions: Options to pass to WebRequest::setCookie():
48 * - prefix: Cookie prefix, defaults to $wgCookiePrefix
49 * - path: Cookie path, defaults to $wgCookiePath
50 * - domain: Cookie domain, defaults to $wgCookieDomain
51 * - secure: Cookie secure flag, defaults to $wgCookieSecure
52 * - httpOnly: Cookie httpOnly flag, defaults to $wgCookieHttpOnly
54 public function __construct( $params = array() ) {
55 parent
::__construct();
58 'cookieOptions' => array(),
59 // @codeCoverageIgnoreStart
61 // @codeCoverageIgnoreEnd
63 if ( !isset( $params['priority'] ) ) {
64 throw new \
InvalidArgumentException( __METHOD__
. ': priority must be specified' );
66 if ( $params['priority'] < SessionInfo
::MIN_PRIORITY ||
67 $params['priority'] > SessionInfo
::MAX_PRIORITY
69 throw new \
InvalidArgumentException( __METHOD__
. ': Invalid priority' );
72 if ( !is_array( $params['cookieOptions'] ) ) {
73 throw new \
InvalidArgumentException( __METHOD__
. ': cookieOptions must be an array' );
76 $this->priority
= $params['priority'];
77 $this->cookieOptions
= $params['cookieOptions'];
78 $this->params
= $params;
79 unset( $this->params
['priority'] );
80 unset( $this->params
['cookieOptions'] );
83 public function setConfig( Config
$config ) {
84 parent
::setConfig( $config );
86 // @codeCoverageIgnoreStart
87 $this->params +
= array(
88 // @codeCoverageIgnoreEnd
89 'callUserSetCookiesHook' => false,
91 $config->get( 'SessionName' ) ?
: $config->get( 'CookiePrefix' ) . '_session',
94 // @codeCoverageIgnoreStart
95 $this->cookieOptions +
= array(
96 // @codeCoverageIgnoreEnd
97 'prefix' => $config->get( 'CookiePrefix' ),
98 'path' => $config->get( 'CookiePath' ),
99 'domain' => $config->get( 'CookieDomain' ),
100 'secure' => $config->get( 'CookieSecure' ),
101 'httpOnly' => $config->get( 'CookieHttpOnly' ),
105 public function provideSessionInfo( WebRequest
$request ) {
107 'id' => $this->getCookie( $request, $this->params
['sessionName'], '' )
109 if ( !SessionManager
::validateSessionId( $info['id'] ) ) {
110 unset( $info['id'] );
113 list( $userId, $userName, $token ) = $this->getUserInfoFromCookies( $request );
114 if ( $userId !== null ) {
116 $userInfo = UserInfo
::newFromId( $userId );
117 } catch ( \InvalidArgumentException
$ex ) {
122 if ( $userName !== null && $userInfo->getName() !== $userName ) {
126 if ( $token !== null ) {
127 if ( !hash_equals( $userInfo->getToken(), $token ) ) {
130 $info['userInfo'] = $userInfo->verified();
131 } elseif ( isset( $info['id'] ) ) { // No point if no session ID
132 $info['userInfo'] = $userInfo;
142 'persisted' => isset( $info['id'] ),
143 'forceHTTPS' => $this->getCookie( $request, 'forceHTTPS', '', false )
146 return new SessionInfo( $this->priority
, $info );
149 public function persistsSessionId() {
153 public function canChangeUser() {
157 public function persistSession( SessionBackend
$session, WebRequest
$request ) {
158 $response = $request->response();
159 if ( $response->headersSent() ) {
160 // Can't do anything now
161 $this->logger
->debug( __METHOD__
. ': Headers already sent' );
165 $user = $session->getUser();
167 $cookies = $this->cookieDataToExport( $user, $session->shouldRememberUser() );
168 $sessionData = $this->sessionDataToExport( $user );
171 if ( $this->params
['callUserSetCookiesHook'] && !$user->isAnon() ) {
172 \Hooks
::run( 'UserSetCookies', array( $user, &$sessionData, &$cookies ) );
175 $options = $this->cookieOptions
;
177 $forceHTTPS = $session->shouldForceHTTPS() ||
$user->requiresHTTPS();
179 // Don't set the secure flag if the request came in
180 // over "http", for backwards compat.
181 // @todo Break that backwards compat properly.
182 $options['secure'] = $this->config
->get( 'CookieSecure' );
185 $response->setCookie( $this->params
['sessionName'], $session->getId(), null,
186 array( 'prefix' => '' ) +
$options
189 $extendedCookies = $this->config
->get( 'ExtendedLoginCookies' );
190 $extendedExpiry = $this->config
->get( 'ExtendedLoginCookieExpiration' );
192 foreach ( $cookies as $key => $value ) {
193 if ( $value === false ) {
194 $response->clearCookie( $key, $options );
196 if ( $extendedExpiry !== null && in_array( $key, $extendedCookies ) ) {
197 $expiry = time() +
(int)$extendedExpiry;
199 $expiry = 0; // Default cookie expiration
201 $response->setCookie( $key, (string)$value, $expiry, $options );
205 $this->setForceHTTPSCookie( $forceHTTPS, $session, $request );
206 $this->setLoggedOutCookie( $session->getLoggedOutTimestamp(), $request );
208 if ( $sessionData ) {
209 $session->addData( $sessionData );
213 public function unpersistSession( WebRequest
$request ) {
214 $response = $request->response();
215 if ( $response->headersSent() ) {
216 // Can't do anything now
217 $this->logger
->debug( __METHOD__
. ': Headers already sent' );
226 $response->clearCookie(
227 $this->params
['sessionName'], array( 'prefix' => '' ) +
$this->cookieOptions
230 foreach ( $cookies as $key => $value ) {
231 $response->clearCookie( $key, $this->cookieOptions
);
234 $this->setForceHTTPSCookie( false, null, $request );
238 * Set the "forceHTTPS" cookie
239 * @param bool $set Whether the cookie should be set or not
240 * @param SessionBackend|null $backend
241 * @param WebRequest $request
243 protected function setForceHTTPSCookie(
244 $set, SessionBackend
$backend = null, WebRequest
$request
246 $response = $request->response();
248 $response->setCookie( 'forceHTTPS', 'true', $backend->shouldRememberUser() ?
0 : null,
249 array( 'prefix' => '', 'secure' => false ) +
$this->cookieOptions
);
251 $response->clearCookie( 'forceHTTPS',
252 array( 'prefix' => '', 'secure' => false ) +
$this->cookieOptions
);
257 * Set the "logged out" cookie
258 * @param int $loggedOut timestamp
259 * @param WebRequest $request
261 protected function setLoggedOutCookie( $loggedOut, WebRequest
$request ) {
262 if ( $loggedOut +
86400 > time() &&
263 $loggedOut !== (int)$this->getCookie( $request, 'LoggedOut', $this->cookieOptions
['prefix'] )
265 $request->response()->setCookie( 'LoggedOut', $loggedOut, $loggedOut +
86400,
266 $this->cookieOptions
);
270 public function getVaryCookies() {
272 // Vary on token and session because those are the real authn
273 // determiners. UserID and UserName don't matter without those.
274 $this->cookieOptions
['prefix'] . 'Token',
275 $this->cookieOptions
['prefix'] . 'LoggedOut',
276 $this->params
['sessionName'],
281 public function suggestLoginUsername( WebRequest
$request ) {
282 $name = $this->getCookie( $request, 'UserName', $this->cookieOptions
['prefix'] );
283 if ( $name !== null ) {
284 $name = User
::getCanonicalName( $name, 'usable' );
286 return $name === false ?
null : $name;
290 * Fetch the user identity from cookies
291 * @param \WebRequest $request
292 * @return array (string|null $id, string|null $username, string|null $token)
294 protected function getUserInfoFromCookies( $request ) {
295 $prefix = $this->cookieOptions
['prefix'];
297 $this->getCookie( $request, 'UserID', $prefix ),
298 $this->getCookie( $request, 'UserName', $prefix ),
299 $this->getCookie( $request, 'Token', $prefix ),
304 * Get a cookie. Contains an auth-specific hack.
305 * @param \WebRequest $request
307 * @param string $prefix
308 * @param mixed $default
311 protected function getCookie( $request, $key, $prefix, $default = null ) {
312 $value = $request->getCookie( $key, $prefix, $default );
313 if ( $value === 'deleted' ) {
314 // PHP uses this value when deleting cookies. A legitimate cookie will never have
315 // this value (usernames start with uppercase, token is longer, other auth cookies
316 // are booleans or integers). Seeing this means that in a previous request we told the
317 // client to delete the cookie, but it has poor cookie handling. Pretend the cookie is
318 // not there to avoid invalidating the session.
325 * Return the data to store in cookies
327 * @param bool $remember
328 * @return array $cookies Set value false to unset the cookie
330 protected function cookieDataToExport( $user, $remember ) {
331 if ( $user->isAnon() ) {
338 'UserID' => $user->getId(),
339 'UserName' => $user->getName(),
340 'Token' => $remember ?
(string)$user->getToken() : false,
346 * Return extra data to store in the session
348 * @return array $session
350 protected function sessionDataToExport( $user ) {
351 // If we're calling the legacy hook, we should populate $session
352 // like User::setCookies() did.
353 if ( !$user->isAnon() && $this->params
['callUserSetCookiesHook'] ) {
355 'wsUserID' => $user->getId(),
356 'wsToken' => $user->getToken(),
357 'wsUserName' => $user->getName(),
364 public function whyNoSession() {
365 return wfMessage( 'sessionprovider-nocookies' );