# Odan/session not persisting data

**URL:** <https://discourse.slimframework.com/t/odan-session-not-persisting-data/5643>\
**Category:** Questions\
**Created:** [June 29, 2023, 3:05pm UTC](https://discourse.slimframework.com/t/odan-session-not-persisting-data/5643 "2023-06-29T15:05:30Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![reinier](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.slimframework.com/reinier/32/1515_2.png) [@reinier](https://discourse.slimframework.com/u/reinier)\
**Post date:** [June 29, 2023, 3:05pm UTC](https://discourse.slimframework.com/t/odan-session-not-persisting-data/5643/1 "2023-06-29T15:05:30Z")

</div>

Struggling with data that is not persisted to the next request.  
Using Slim 4 and odan\session 6.

I’m adding session middleware to every route/request, in routes.php:

```auto
$sessionMiddleware = new SessionStartMiddleware(
    new PhpSession($sessionSettings['options'])
);

$myRoute->add($sessionMiddleware);
$myOtherRoute->add($sessionMiddleware);

```

Added it in the container:

```auto
PhpSession::class => DI\create()->constructor($settings['session']['options']),

```

So I can get it injected in my controller using the constructor:

```auto
public function __construct(
    private PhpSession $session,
) {}

```

Everything works. Except the data i save to the session is not showing up in a next request. Just an empty `PhpSession()`:

```auto
$this = {\App\Auth\AuthMiddleWare} 
 session = {Odan\Session\PhpSession} 
  storage = {array[0]} 
  flash = {Odan\Session\Flash} 
   storage = {array[0]} 
   storageKey = "_flash"
  options = {array[8]} 
   id = null
   name = "app"
   lifetime = {int} 29030400
   path = null
   domain = null
   secure = false
   httponly = true
   cache_limiter = "nocache"

```

It’s not setting the ‘id’, is that maybe the problem?

---

<div class="post-metadata">

**Author:** ![odan](https://avatars.discourse-cdn.com/v4/letter/o/9de053/32.png) [@odan](https://discourse.slimframework.com/u/odan)\
**Post date:** [June 29, 2023, 3:32pm UTC](https://discourse.slimframework.com/t/odan-session-not-persisting-data/5643/2 "2023-06-29T15:32:49Z")

</div>

Hi @reinier

I guess that the SessionStartMiddleware is not correctly (redundant) configured within the DI container. See here for a working example: [odan/session Slim 4 Integration](https://odan.github.io/session/v6/#slim-4-integration):

---

<div class="post-metadata">

**Author:** ![reinier](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.slimframework.com/reinier/32/1515_2.png) [@reinier](https://discourse.slimframework.com/u/reinier)\
**Post date:** [June 29, 2023, 6:27pm UTC](https://discourse.slimframework.com/t/odan-session-not-persisting-data/5643/3 "2023-06-29T18:27:22Z")

</div>

Yes! Thank you.

Totally missed that part at the bottom of the documentation page.  
I now have session and subsequently authentication working in my project 🙏

Now on to authorization 😰 Do you maybe have any recommendations for a package to implement that in Slim?

---

<div class="post-metadata">

**Author:** ![odan](https://avatars.discourse-cdn.com/v4/letter/o/9de053/32.png) [@odan](https://discourse.slimframework.com/u/odan)\
**Post date:** [June 29, 2023, 7:41pm UTC](https://discourse.slimframework.com/t/odan-session-not-persisting-data/5643/4 "2023-06-29T19:41:34Z")

</div>

> [@reinier](#):
>
> Now on to authorization 😰 Do you maybe have any recommendations for a package to implement that in Slim?

I guess with Authorization, you mean some kind of “Access control” when the user is already logged in. Well, it depends,on your specific requirements, e.g., Role based or ACL.

---

<div class="post-metadata">

**Author:** ![reinier](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.slimframework.com/reinier/32/1515_2.png) [@reinier](https://discourse.slimframework.com/u/reinier)\
**Post date:** [June 29, 2023, 8:05pm UTC](https://discourse.slimframework.com/t/odan-session-not-persisting-data/5643/5 "2023-06-29T20:05:17Z")

</div>

I’m thinking RBAC. I already use some symfony core security classes that prepare for roles and their ‘firewalls’. I need to be able to assign roles but ideally also turn on/off specific features per user. Not sure if there is a name for that kind of access.

---

<div class="post-metadata">

**Author:** ![odan](https://avatars.discourse-cdn.com/v4/letter/o/9de053/32.png) [@odan](https://discourse.slimframework.com/u/odan)\
**Post date:** [June 29, 2023, 9:30pm UTC](https://discourse.slimframework.com/t/odan-session-not-persisting-data/5643/6 "2023-06-29T21:30:50Z")

</div>

> [@reinier](#):
>
> RBAC

Then you may take a look at the [laminas/laminas-permissions-rbac](https://docs.laminas.dev/laminas-permissions-rbac/examples/) package.