Do not overwrite the current setting in session storage if cookie_secure is set to auto, and resolve this auto value immediately when the SessionListener event is called.

tamcy · tamcy · commit 0016095a6fa6 · 2021-02-18T11:56:44.000+08:00
diff --git a/src/Symfony/Component/HttpFoundation/Session/Storage/NativeSessionStorage.php b/src/Symfony/Component/HttpFoundation/Session/Storage/NativeSessionStorage.php
@@ -389,6 +389,10 @@ public function setOptions(array $options)
                     $this->emulateSameSite = $value;
                     continue;
                 }
+                if ('cookie_secure' === $key && 'auto' === $value) {
+                    // Do not overwrite existing setting if the cookie_secure value is "auto".
+                    continue;
+                }
                 ini_set('url_rewriter.tags' !== $key ? 'session.'.$key : $key, $value);
             }
         }
diff --git a/src/Symfony/Component/HttpKernel/EventListener/SessionListener.php b/src/Symfony/Component/HttpKernel/EventListener/SessionListener.php
@@ -14,6 +14,7 @@
 use Psr\Container\ContainerInterface;
 use Symfony\Component\HttpFoundation\Session\SessionInterface;
 use Symfony\Component\HttpFoundation\Session\Storage\NativeSessionStorage;
+use Symfony\Component\HttpKernel\Event\GetResponseEvent;
 
 /**
  * Sets the session in the request.
@@ -33,10 +34,12 @@ public function __construct(ContainerInterface $container)
         $this->container = $container;
     }
 
-    protected function getSession(): ?SessionInterface
+    public function onKernelRequest(GetResponseEvent $event)
     {
-        if (!$this->container->has('session')) {
-            return null;
+        parent::onKernelRequest($event);
+
+        if (!$event->isMasterRequest() || !$this->container->has('session')) {
+            return;
         }
 
         if ($this->container->has('session_storage')
@@ -46,6 +49,13 @@ protected function getSession(): ?SessionInterface
         ) {
             $storage->setOptions(['cookie_secure' => true]);
         }
+    }
+
+    protected function getSession(): ?SessionInterface
+    {
+        if (!$this->container->has('session')) {
+            return null;
+        }
 
         return $this->container->get('session');
     }

Original file line number	Diff line number	Diff line change
`@@ -389,6 +389,10 @@ public function setOptions(array $options)`
`389`	`389`	`$this->emulateSameSite = $value;`
`390`	`390`	`continue;`
`391`	`391`	`}`
	`392`	`+ if ('cookie_secure' === $key && 'auto' === $value) {`
	`393`	`+ // Do not overwrite existing setting if the cookie_secure value is "auto".`
	`394`	`+ continue;`
	`395`	`+ }`
`392`	`396`	`ini_set('url_rewriter.tags' !== $key ? 'session.'.$key : $key, $value);`
`393`	`397`	`}`
`394`	`398`	`}`