RFC: Session handling when using Symfony framework

[brefphp]

RFC: Session handling when using Symfony framework

[mnapoli]

Wow that is awesome thanks for all the details.

The Symfony adapter is supposed to take care of the details, so I think we should do that by default (until we have a better solution at least).

This is weird that Symfony does not set the Set-Cookie header.

the framework has its own interface for accessing the its own internal session handling, meaning you can't use session_id() or other session_... methods for interacting with the session handling.

Is this the root cause from what you've seen? Maybe there an implementation that we can write for this interface that would work better? I haven't digged yet though.

[nealio82]

I believe this to be the cause. It appears to make sense that it would be the problem, as other frameworks have been demonstrated to be working with sessions / bref

In debugging this I initially wrote a bridge extending the Synmfony PdoSessionHandler class and set a constant session id, and returned the same session id from SymfonyAdapter. Once I added the lines to set the cookie id above the call to handle(), i was able to remove my bridge and the example code above is the minimum required in order to have session support right now.

This is weird that Symfony does not set the Set-Cookie header.

I agree. I have to wonder if the Symfony session handling requires something from the PHP $_SESSION superglobal which isn't available from the compiled php binary supplied with bref, or from the CLI environment it is invoked by in order to manage the session fully.

However, I'm not familiar enough with the Symfony session component to fully debug / understand why it's not returned in the response from the Kernel.

The Symfony adapter is supposed to take care of the details, so I think we should do that by default (until we have a better solution at least).

Ok, I can make a PR for this. I was hesitant to do it by default as it's a problem which only shows itself when you want to actually use session storage, rather than something which is needed 100% of the time (although, thinking about it, forms with CSRF protection will also need to use session storage)