Skip to content

Commit 0f1199b

Browse files
OskarStarkclaude
OskarStark
and
claude
committed
[HttpFoundation] Remove deprecated session options from NativeSessionStorage
Remove the following deprecated session options: referer_check, use_only_cookies, use_trans_sid, sid_length, sid_bits_per_character, trans_sid_hosts, trans_sid_tags - Remove BC BREAK prefix from CHANGELOG entry - Add UPGRADE-8.0.md entry with before/after examples - Remove legacy test for trans_sid_tags option - Keep symfony/deprecation-contracts as it's still needed for Response.php 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
1 parent 6ab4a14 commit 0f1199b

File tree

4 files changed

+47
-71
lines changed

4 files changed

+47
-71
lines changed

‎UPGRADE-8.0.md‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -152,6 +152,45 @@ FrameworkBundle
152152
$application->addCommand(new CreateUserCommand());
153153
```
154154

155+
HttpFoundation
156+
--------------
157+
158+
* Remove the following deprecated session options from `NativeSessionStorage`: `referer_check`, `use_only_cookies`, `use_trans_sid`, `sid_length`, `sid_bits_per_character`, `trans_sid_hosts`, `trans_sid_tags`
159+
160+
*Before*
161+
```php
162+
use Symfony\Component\HttpFoundation\Session\Storage\NativeSessionStorage;
163+
164+
$storage = new NativeSessionStorage([
165+
'referer_check' => 'http://example.com',
166+
'use_only_cookies' => true,
167+
'use_trans_sid' => false,
168+
'sid_length' => 48,
169+
'sid_bits_per_character' => 6,
170+
'trans_sid_hosts' => 'example.com',
171+
'trans_sid_tags' => 'a=href,area=href',
172+
]);
173+
```
174+
175+
*After*
176+
```php
177+
use Symfony\Component\HttpFoundation\Session\Storage\NativeSessionStorage;
178+
179+
// These options are no longer supported and should be removed
180+
$storage = new NativeSessionStorage([
181+
// Configure other session options as needed
182+
]);
183+
184+
// Use PHP's session configuration functions directly if needed:
185+
// ini_set('session.referer_check', 'http://example.com');
186+
// ini_set('session.use_only_cookies', '1');
187+
// ini_set('session.use_trans_sid', '0');
188+
// ini_set('session.sid_length', '48');
189+
// ini_set('session.sid_bits_per_character', '6');
190+
// ini_set('session.trans_sid_hosts', 'example.com');
191+
// ini_set('session.trans_sid_tags', 'a=href,area=href');
192+
```
193+
155194
HttpClient
156195
----------
157196

‎src/Symfony/Component/HttpFoundation/CHANGELOG.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,11 @@
11
CHANGELOG
22
=========
33

4+
8.0
5+
---
6+
7+
* Remove the following deprecated session options from `NativeSessionStorage`: `referer_check`, `use_only_cookies`, `use_trans_sid`, `sid_length`, `sid_bits_per_character`, `trans_sid_hosts`, `trans_sid_tags`
8+
49
7.4
510
---
611

‎src/Symfony/Component/HttpFoundation/Session/Storage/NativeSessionStorage.php‎

Lines changed: 3 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -62,16 +62,9 @@ class NativeSessionStorage implements SessionStorageInterface
6262
* gc_probability, "1"
6363
* lazy_write, "1"
6464
* name, "PHPSESSID"
65-
* referer_check, "" (deprecated since Symfony 7.2, to be removed in Symfony 8.0)
6665
* serialize_handler, "php"
6766
* use_strict_mode, "1"
6867
* use_cookies, "1"
69-
* use_only_cookies, "1" (deprecated since Symfony 7.2, to be removed in Symfony 8.0)
70-
* use_trans_sid, "0" (deprecated since Symfony 7.2, to be removed in Symfony 8.0)
71-
* sid_length, "32" (@deprecated since Symfony 7.2, to be removed in 8.0)
72-
* sid_bits_per_character, "5" (@deprecated since Symfony 7.2, to be removed in 8.0)
73-
* trans_sid_hosts, $_SERVER['HTTP_HOST'] (deprecated since Symfony 7.2, to be removed in Symfony 8.0)
74-
* trans_sid_tags, "a=href,area=href,frame=src,form=" (deprecated since Symfony 7.2, to be removed in Symfony 8.0)
7568
*/
7669
public function __construct(array $options = [], AbstractProxy|\SessionHandlerInterface|null $handler = null, ?MetadataBag $metaBag = null)
7770
{
@@ -122,25 +115,19 @@ public function start(): bool
122115
*
123116
* ---------- Part 1
124117
*
125-
* The part `[a-zA-Z0-9,-]` is related to the PHP ini directive `session.sid_bits_per_character` defined as 6.
118+
* The part `[a-zA-Z0-9,-]` corresponds to the character range when PHP's `session.sid_bits_per_character` is set to 6.
126119
* See https://www.php.net/manual/en/session.configuration.php#ini.session.sid-bits-per-character.
127-
* Allowed values are integers such as:
128-
* - 4 for range `a-f0-9`
129-
* - 5 for range `a-v0-9` (@deprecated since Symfony 7.2, it will default to 4 and the option will be ignored in Symfony 8.0)
130-
* - 6 for range `a-zA-Z0-9,-` (@deprecated since Symfony 7.2, it will default to 4 and the option will be ignored in Symfony 8.0)
131120
*
132121
* ---------- Part 2
133122
*
134-
* The part `{22,250}` is related to the PHP ini directive `session.sid_length`.
123+
* The part `{22,250}` defines the acceptable length range for session IDs.
135124
* See https://www.php.net/manual/en/session.configuration.php#ini.session.sid-length.
136125
* Allowed values are integers between 22 and 256, but we use 250 for the max.
137126
*
138127
* Where does the 250 come from?
139128
* - The length of Windows and Linux filenames is limited to 255 bytes. Then the max must not exceed 255.
140129
* - The session filename prefix is `sess_`, a 5 bytes string. Then the max must not exceed 255 - 5 = 250.
141130
*
142-
* This is @deprecated since Symfony 7.2, the sid length will default to 32 and the option will be ignored in Symfony 8.0.
143-
*
144131
* ---------- Conclusion
145132
*
146133
* The parts 1 and 2 prevent the warning below:
@@ -323,17 +310,11 @@ public function setOptions(array $options): void
323310
'cache_expire', 'cache_limiter', 'cookie_domain', 'cookie_httponly',
324311
'cookie_lifetime', 'cookie_path', 'cookie_secure', 'cookie_samesite',
325312
'gc_divisor', 'gc_maxlifetime', 'gc_probability',
326-
'lazy_write', 'name', 'referer_check',
313+
'lazy_write', 'name',
327314
'serialize_handler', 'use_strict_mode', 'use_cookies',
328-
'use_only_cookies', 'use_trans_sid',
329-
'sid_length', 'sid_bits_per_character', 'trans_sid_hosts', 'trans_sid_tags',
330315
]);
331316

332317
foreach ($options as $key => $value) {
333-
if (\in_array($key, ['referer_check', 'use_only_cookies', 'use_trans_sid', 'trans_sid_hosts', 'trans_sid_tags', 'sid_length', 'sid_bits_per_character'], true)) {
334-
trigger_deprecation('symfony/http-foundation', '7.2', 'NativeSessionStorage\'s "%s" option is deprecated and will be ignored in Symfony 8.0.', $key);
335-
}
336-
337318
if (isset($validOptions[$key])) {
338319
if ('cookie_secure' === $key && 'auto' === $value) {
339320
continue;

‎src/Symfony/Component/HttpFoundation/Tests/Session/Storage/NativeSessionStorageTest.php‎

Lines changed: 0 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -217,32 +217,6 @@ public function testCacheExpireOption()
217217
$this->assertSame('200', \ini_get('session.cache_expire'));
218218
}
219219

220-
/**
221-
* @group legacy
222-
*
223-
* The test must only be removed when the "session.trans_sid_tags" option is removed from PHP or when the "trans_sid_tags" option is no longer supported by the native session storage.
224-
*/
225-
public function testTransSidTagsOption()
226-
{
227-
$this->expectUserDeprecationMessage('Since symfony/http-foundation 7.2: NativeSessionStorage\'s "trans_sid_tags" option is deprecated and will be ignored in Symfony 8.0.');
228-
229-
$previousErrorHandler = set_error_handler(function ($errno, $errstr) use (&$previousErrorHandler) {
230-
if ('ini_set(): Usage of session.trans_sid_tags INI setting is deprecated' !== $errstr) {
231-
return $previousErrorHandler ? $previousErrorHandler(...\func_get_args()) : false;
232-
}
233-
});
234-
235-
try {
236-
$this->getStorage([
237-
'trans_sid_tags' => 'a=href',
238-
]);
239-
} finally {
240-
restore_error_handler();
241-
}
242-
243-
$this->assertSame('a=href', \ini_get('session.trans_sid_tags'));
244-
}
245-
246220
public function testSetSaveHandler()
247221
{
248222
$initialSaveHandler = ini_set('session.save_handler', 'files');
@@ -365,27 +339,4 @@ public function testSaveHandlesNullSessionGracefully()
365339
$this->addToAssertionCount(1);
366340
}
367341

368-
/**
369-
* @group legacy
370-
*/
371-
public function testPassingDeprecatedOptions()
372-
{
373-
$this->expectUserDeprecationMessage('Since symfony/http-foundation 7.2: NativeSessionStorage\'s "sid_length" option is deprecated and will be ignored in Symfony 8.0.');
374-
$this->expectUserDeprecationMessage('Since symfony/http-foundation 7.2: NativeSessionStorage\'s "sid_bits_per_character" option is deprecated and will be ignored in Symfony 8.0.');
375-
$this->expectUserDeprecationMessage('Since symfony/http-foundation 7.2: NativeSessionStorage\'s "referer_check" option is deprecated and will be ignored in Symfony 8.0.');
376-
$this->expectUserDeprecationMessage('Since symfony/http-foundation 7.2: NativeSessionStorage\'s "use_only_cookies" option is deprecated and will be ignored in Symfony 8.0.');
377-
$this->expectUserDeprecationMessage('Since symfony/http-foundation 7.2: NativeSessionStorage\'s "use_trans_sid" option is deprecated and will be ignored in Symfony 8.0.');
378-
$this->expectUserDeprecationMessage('Since symfony/http-foundation 7.2: NativeSessionStorage\'s "trans_sid_hosts" option is deprecated and will be ignored in Symfony 8.0.');
379-
$this->expectUserDeprecationMessage('Since symfony/http-foundation 7.2: NativeSessionStorage\'s "trans_sid_tags" option is deprecated and will be ignored in Symfony 8.0.');
380-
381-
$this->getStorage([
382-
'sid_length' => 42,
383-
'sid_bits_per_character' => 6,
384-
'referer_check' => 'foo',
385-
'use_only_cookies' => 'foo',
386-
'use_trans_sid' => 'foo',
387-
'trans_sid_hosts' => 'foo',
388-
'trans_sid_tags' => 'foo',
389-
]);
390-
}
391342
}

0 commit comments

Comments
 (0)