Del\SessionManager

Complexity

Total Complexity

35

Size/Duplication

Total Lines	236
Duplicated Lines	0 %

Importance

Changes	11
Bugs	2	Features	3

16 Methods

Rating	Name	Duplication	Size	Complexity
A	shouldRandomlyRegenerate()	0	3	1
A	isValid()	0	11	5
A	sessionStart()	0	20	5
A	__construct()	0	2	1
A	regenerateSession()	0	25	3
A	__clone()	0	2	1
A	getIpAddress()	0	5	1
A	has()	0	3	1
A	getInstance()	0	9	2
A	get()	0	3	2
A	destroySession()	0	8	2
A	unset()	0	3	1
A	initialise()	0	17	3
A	destroy()	0	3	1
A	isHijackAttempt()	0	18	5
A	set()	0	3	1

<?php declare(strict_types=1);

namespace Del;

final class SessionManager
{
    const IP_REGEX = '/(\d{1,3}\.\d{1,3}\.\d{1,3}\.)(\d{1,3})/';

    /**
     *  As this is a singleton, construction and clone are disabled
     *  use SessionManager::getInstance() if you need the instance
     */
    private function __construct()
    {
    }

    private function __clone()
    {
    }

    /**
     * @return SessionManager
     */
    public static function getInstance(): SessionManager
    {
        static $inst = null;

        if ($inst === null) {
            $inst = new SessionManager();
        }

        return $inst;
    }

    /**
     * Creates a secure session
     *
     * @param string $name
     * @param int $lifetime
     * @param string $path
     * @param string $domain
     * @param bool|null $secure
     */
    public static function sessionStart(string $name, int $lifetime = 0, string $path = '/', string $domain = '', ?bool $secure = null): void
    {
        // get the instance of the session manager
        $inst = self::getInstance();

        // Set the domain to default to the current domain.
        $domain = isset($domain) ? $domain : $_SERVER['SERVER_NAME'];

        // Set the default secure value to whether the site is being accessed with SSL
        $secure = isset($secure) ? $secure : isset($_SERVER['HTTPS']);
        $id = session_id();

        if (empty($id)) {
            session_name($name . '_Session');
            session_set_cookie_params($lifetime, $path, $domain, $secure, true);
            session_start();
        }

        // Make sure the session hasn't expired, and destroy it if it has
        $inst->isValid() ? $inst->initialise() :  $inst->destroySession();

    }

    private function initialise(): void
    {
        // Check to see if the session is a hijacking attempt
        if ($this->isHijackAttempt()) {

            // Reset session data and regenerate id
            $_SESSION = [];
            $_SESSION['ipAddress'] = $this->getIpAddress();
            $_SESSION['userAgent'] = $_SERVER['HTTP_USER_AGENT'] ?? '';
            $this->regenerateSession();

            return;
        }

        // Give a 5% chance of the session id changing on any request
        if ($this->shouldRandomlyRegenerate()) {
            $this->regenerateSession();
        }
    }

    /**
     * @return bool
     */
    private function shouldRandomlyRegenerate(): bool
    {
        return rand(1, 100) <= 5;
    }


    /**
     * Checks session IP and user agent are still the same
     * @return bool
     */
    private function isHijackAttempt(): bool
    {
        $ipAddress = $this->getIpAddress();
        $userAgent = $_SERVER['HTTP_USER_AGENT'] ?? '';

        if (!isset($_SESSION['ipAddress']) || !isset($_SESSION['userAgent'])) {
            return true;
        }

        if ($_SESSION['ipAddress'] != $ipAddress) {
            return true;
        }

        if ($_SESSION['userAgent'] !== $userAgent) {
            return true;
        }

        return false;
    }

    /**
     * If a site goes through the likes of Cloudflare, the last part of the IP might change
     * So we replace it with an x.
     *
     * @return string
     */
    private function getIpAddress(): string
    {
        $remoteAddress = $_SERVER['REMOTE_ADDR'] ?? '';

        return preg_replace(self::IP_REGEX, '$1x', $remoteAddress);
    }

    /**
     *  Creates a fresh session Id to make it harder to hack
     *  If the site is very slow in parts increase the expiry time
     *  10 seconds is a good default which allows ajax calls to work
     *  without losing the session
     */
    private function regenerateSession()
    {
        // If this session is obsolete it means there already is a new id
        if (isset($_SESSION['OBSOLETE']) && $_SESSION['OBSOLETE'] == true) {
            return;
        }

        // Set current session to expire in 10 seconds
        $_SESSION['OBSOLETE'] = true;
        $_SESSION['EXPIRES'] = time() + 10;

        // Create new session without destroying the old one
        session_regenerate_id(false);

        // Grab current session ID and close both sessions to allow other scripts to use them
        $newSession = session_id();
        session_write_close();

        // Set session ID to the new one, and start it back up again
        session_id($newSession);
        session_start();

        // Now we unset the obsolete and expiration values for the session we want to keep
        unset($_SESSION['OBSOLETE']);
        unset($_SESSION['EXPIRES']);
    }

    /**
     * Checks whether the session has expired or not
     * @return bool
     */
    private function isValid(): bool
    {
        if (isset($_SESSION['OBSOLETE']) && !isset($_SESSION['EXPIRES'])) {
            return false;
        }

        if (isset($_SESSION['EXPIRES']) && $_SESSION['EXPIRES'] < time()) {
            return false;
        }

        return true;
    }

    /**
     *  Resets the session
     */
    public static function destroySession()
    {
        $id = session_id();

        if (!empty($id)) {
            $_SESSION = [];
            session_destroy();
            session_start();
        }
    }

    /**
     * @param string $key
     * @param mixed $val
     */
    public function set(string $key, $val): void
    {
        $_SESSION[$key] = $val;
    }

    /**
     * @param $key
     * @return null|mixed
     */
    public function get(string $key)
    {
        return isset($_SESSION[$key]) ? $_SESSION[$key] : null;
    }

    /**
     * @param string $key
     * @return bool
     */
    public function has(string $key): bool
    {
        return isset($_SESSION[$key]);
    }

    /**
     * @param $key
     * @param $val
     */
    public function unset(string $key): void
    {
        unset($_SESSION[$key]);
    }

    /**
     * @param $key
     * @param $val
     * @deprecated use unset
     */
    public function destroy(string $key): void
    {
        unset($_SESSION[$key]);
    }
}