Add the createId() method of SessionInterface and then use it in SessionMiddleware when requestSessionId is null

[klsoft-web]

To prevent the same session ID being received for both Swoole and Road Runner, add the createId() method of SessionInterface and then use it in SessionMiddleware when requestSessionId is null

Q	A
Is bugfix?	✔️
New feature?	✔️
Breaks BC?	✔️
Fixed issues	#25

[codecov]

Codecov Report

❌ Patch coverage is 85.71429% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 99.47%. Comparing base (4ccc68f) to head (25a0b45).

Files with missing lines	Patch %	Lines
src/Session.php	80.00%	1 Missing ⚠️

Additional details and impacted files

@@              Coverage Diff              @@
##              master      #88      +/-   ##
=============================================
- Coverage     100.00%   99.47%   -0.53%     
- Complexity        77       78       +1     
=============================================
  Files              3        3              
  Lines            187      192       +5     
=============================================
+ Hits             187      191       +4     
- Misses             0        1       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[samdark]

Changed behavior is not covered with tests.

Overall, I think the fix should be in Session::open() so anonymous requests are not producing new sessions.

[samdark]

That causes creating a new empty session for every anonymous request, which is very wasteful. Also, Set-Cookie is sent on every response, so it's impossible to cache static anonymous pages.

[samdark]

Also, it will likely cause a fatal error in commitSession() for HTTP-requests (not HTTPS):

1. Session ID is always assigned now, so $currentSessionId === null is never true.
2. It will try to build a cookie and if that's 2nd request, the error will be "cookie_secure" is on but connection is not secure... since secure cookie is default.

[klsoft-web]

2. It will try to build a cookie and if that's 2nd request, the error will be "cookie_secure" is on but connection is not secure... since secure cookie is default.

When I set 'options' => 'cookie_secure' => 1, I get an error on the first request. However, I get the same error with the existing code:

        if ($requestSessionId !== null && $this->session->getId() === null) {
            $this->session->setId($requestSessionId);
        }

[klsoft-web]

That causes creating a new empty session for every anonymous request, which is very wasteful. Also, Set-Cookie is sent on every response, so it's impossible to cache static anonymous pages.

I don't understand the point of the comment, since the current version of the yiisoft/session package also sends Set-Cookie with an empty PHPSESSID cookie on every request.

[klsoft-web]

1. Session ID is always assigned now, so $currentSessionId === null is never true.

I think it makes sense to replace the createId() call within the Session::open() method.

Replace this code:

if ($this->sessionId !== null) {
  session_id($this->sessionId);
}

With:

session_id($this->sessionId ?? $this->createId());

What do you think?

[klsoft-web]

Overall, I think the fix should be in Session::open() so anonymous requests are not producing new sessions.

Yes, the issue occurred in Session::open() on this line, but it calls a PHP function, not Yii3 code.

$this->sessionId = session_id();