THttpSession provides session-level data management and the related configurations.
To start the session, call {@link open}; to complete and send out session data, call {@link close};
to destroy the session, call {@link destroy}. If AutoStart is true, then the session
will be started once the session module is loaded and initialized.
To access data stored in session, use THttpSession like an associative array. For example,
$session=new THttpSession;
$session->open();
$value1=$session['name1']; // get session variable 'name1'
$value2=$session['name2']; // get session variable 'name2'
foreach($session as $name=>$value) // traverse all session variables
$session['name3']=$value3; // set session variable 'name3'
The following configurations are available for session:
{@link setAutoStart AutoStart}, {@link setCookieMode CookieMode},
{@link setSavePath SavePath},
{@link setUseCustomStorage UseCustomStorage}, {@link setGCProbability GCProbability},
{@link setTimeout Timeout}.
See the corresponding setter and getter documentation for more information.
Note, these properties must be set before the session is started.
THttpSession can be inherited with customized session storage method.
Override {@link _open}, {@link _close}, {@link _read}, {@link _write}, {@link _destroy} and {@link _gc}
and set {@link setUseCustomStorage UseCustomStorage} to true.
Then, the session data will be stored using the above methods.
By default, THttpSession is registered with {@link TApplication} as the
request module. It can be accessed via {@link TApplication::getSession()}.
THttpSession may be configured in application configuration file as follows,
where {@link getSessionName SessionName}, {@link getSavePath SavePath},
{@link getCookieMode CookieMode}, {@link getUseCustomStorage UseCustomStorage}, {@link getAutoStart AutoStart}, {@link getGCProbability GCProbability}, {@link getUseTransparentSessionID UseTransparentSessionID}
and {@link getTimeout TimeOut} are configurable properties of THttpSession.
To avoid the possibility of identity theft through some variants of XSS attacks,
THttpSessionshould always be configured to enforce HttpOnly setting on session cookie.
The HttpOnly setting is disabled by default. To enable it, configure the THttpSession
module as follows,
/**
* Initializes the module.
* This method is required by IModule.
* It reads the CacheModule property.
* @param TXmlElement module configuration
*/
public function init($config)
{
if ($this->_cacheModuleID === '') {
throw new TConfigurationException('cachesession_cachemoduleid_required');
} else {
if (($cache = $this->getApplication()->getModule($this->_cacheModuleID)) === null) {
throw new TConfigurationException('cachesession_cachemodule_inexistent', $this->_cacheModuleID);
} else {
if ($cache instanceof ICache) {
$this->_cache = $cache;
} else {
throw new TConfigurationException('cachesession_cachemodule_invalid', $this->_cacheModuleID);
}
}
}
$this->setUseCustomStorage(true);
parent::init($config);
}
