Yiisoft\Yii\Web\Session\SessionMiddleware

Complexity

Total Complexity

11

Size/Duplication

Total Lines	66
Duplicated Lines	0 %

Test Coverage

Coverage

97.06%

Importance

Changes	1
Bugs	0	Features	1

4 Methods

Rating	Name	Duplication	Size	Complexity
A	__construct()	0	3	1
A	getSidFromRequest()	0	4	1
B	commitSession()	0	39	7
A	process()	0	10	2

<?php
namespace Yiisoft\Yii\Web\Session;

use Psr\Http\Message\ResponseInterface;
use Psr\Http\Message\ServerRequestInterface;
use Psr\Http\Server\MiddlewareInterface;
use Psr\Http\Server\RequestHandlerInterface;
use Yiisoft\Yii\Web\Cookie;

class SessionMiddleware implements MiddlewareInterface
{
    private $session;

    public function __construct(SessionInterface $session)
    {
        $this->session = $session;
    }

    public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface
    {
        try {
            $response = $handler->handle($request);
        } catch (\Throwable $e) {
            $this->session->discard();
            throw $e;
        }

        return $this->commitSession($request, $response);
    }

    private function commitSession(ServerRequestInterface $request, ResponseInterface $response): ResponseInterface
    {
        if (!$this->session->isActive()) {
            return $response;
        }

        $this->session->close();

        $currentSid = $this->session->getID();

        // SID changed, neeed to send new cookie
        if ($this->getSidFromRequest($request) !== $currentSid) {
            $cookieParameters = $this->session->getCookieParameters();

            $cookieDomain = $cookieParameters['domain'];
            if (empty($cookieDomain)) {
                $cookieDomain = $request->getUri()->getHost();
            }

            $useSecureCookie = $cookieParameters['secure'];
            if ($useSecureCookie && $request->getUri()->getScheme() !== 'https') {
                throw new SessionException('"cookie_secure" is on but connection is not secure. Either set Session "cookie_secure" option to "0" or make connection secure');
            }

            $sessionCookie = (new Cookie($this->session->getName(), $currentSid))

It seems like $currentSid can also be of type null; however, parameter $value of Yiisoft\Yii\Web\Cookie::__construct() does only seem to accept string, maybe add an additional type check?

                ->path($cookieParameters['path'])
                ->domain($cookieDomain)
                ->httpOnly($cookieParameters['httponly'])
                ->secure($useSecureCookie)
                ->sameSite($cookieParameters['samesite'] ?? Cookie::SAME_SITE_LAX);

            if ($cookieParameters['lifetime'] > 0) {
                $sessionCookie = $sessionCookie->validFor(new \DateInterval('PT' . $cookieParameters['lifetime'] . 'S'));
            }

            return $sessionCookie->addToResponse($response);
        }

        return $response;
    }

    private function getSidFromRequest(ServerRequestInterface $request): ?string
    {
        $cookies = $request->getCookieParams();
        return $cookies[$this->session->getName()] ?? null;
    }
}