Session middleware

21

Thanks a lot. Let me know if you need/want any help.

22

Here is a CSRF protection package that uses Secure Session Middleware

  • creates HTML form hidden input for CSRF token and injects it automatically to template engine
  • super easy to use and manage
23

Session namespace support is added on this package now.

Secure session middleware for Slim 3 framework

24

Very nice, thankā€™s a lot. Iā€™ll install and test tonight.

25

I made an Encryption service for Slim 3 (based on an old encryption class I wrote). Perhaps you can comment on it?

https://github.com/scheperr/slim3-encryption

26

Mcrypt shouldnā€™t be used at all these days, i.e. https://paragonie.com/blog/2015/05/if-you-re-typing-word-mcrypt-into-your-code-you-re-doing-it-wrong

27

Dot notation is interesting idea and I just finished my class for it, can be used with any arrays, not just with Slim: https://github.com/adbario/php-dot-notation

But still thinking about this session, namespacing and dot notation, and how useful they are together. Basically namespacing is what dot notation gives you as well, and accessing all data is that way a bit easier than changing namespace first. Well, lets see :slight_smile:

28

Basically namespacing is what dot notation gives you as well, and accessing all data is that way a bit easier than changing namespace first. Well, lets see

Iā€™m sorry, but I disagree with your reasoning.

Namespacing gives you an automatic manner to separate your stuff (for the purpose of this discussion ā€œyour stuffā€ is the stuff set in your Slim application) in session from the global session namespace. Yes, the same thing can be achieved by using dot notation, but that requires you to manually apply namespacing through dot notation on every session get/set.

These days we pull in lots of external package through composer some of which may use session to store data. If you namespace your slim session data, it means that this data is automatically separated from the stuff these these other packages place into session. It may seem like a trivial difference, but when tracing/debugging complex applications, this separation can be quite useful and is a welcome addition.

All IMHO of course :grinning:

29

BTW, you write nice, clean and readable code. Nice job!

30

Fair points and it kind of makes sense. But at the same time, personally I never had any that kind of problems with session data, but it doesnā€™t mean that there couldnā€™t be any problems in future, so itā€™s true that namespacing prevents that. And if you donā€™t need namespacing for your own app, it doesnā€™t matter as it works as an invisible layer.

Iā€™ll connect dot notation and session management soon together, then it should be pretty solid and secure package for multiple uses.

Thanks for commenting!

31

Thanks for commenting!

Thanks for considering my arguments.

32

Package now has dot notation as well. Give it a try and throw some comments, if you have few minutes :slight_smile:

Readme is pretty long now, as there are plenty of different ways to use sessions, but it should be pretty easy to follow.

33

Hi @RikuS

Iā€™m sorry I havenā€™t gotten back to you yet but Iā€™ve been stuck with a rush/emergency project which I need to get out of the way. Once that is done, Iā€™ll test, comment and provide feedback.

34

This looks terrific @RikuS but I think it is php7 only, yes?

35

Thanks for posting! Yes I used scalar type hinting which is not supported by PHP 5. Will fix that soon.

36

Package supports now fully both PHP 5 and 7.

37

Thank you, I hope to finally have some time to actually use your package; itā€™s been a total madhouse for me over the past 2 weeks ā€¦

38

Finally finding time to try to integrate all your packages (thanks!), unfortunately Iā€™m running into a problem:

: composer require adbario/slim-csrf
Problem 1
    - Installation request for adbario/slim-csrf ^1.0 -> satisfiable by adbario/slim-csrf[1.0.0].
    - adbario/slim-csrf 1.0.0 requires adbario/slim-secure-session-middleware ~1.0.0 -> no matching package found.

It seems that the required version tag for slim-csrf is incompatible with the newest version of your slim-secure-session-middleware. Any chance you could cut a new package to fix this?

Thanks a lot in advance.

39

Hi! Yeah that was a mistake, fixed now. Thanks for posting!

1 Like
40

Thank you, it now installs successfully. Will integrate and test tonight.