[FrameworkBundle] start session on flashbag injection #36063

warslett · 2020-03-13T17:54:22Z

Q	A
Branch?	3.4
Bug fix?	yes
New feature?	no
Deprecations?	no
Tickets	Fix #33084
License	MIT

This PR addresses an issue whereby if the FlashBag is injected into the application using the default service configuration, we cannot rely that the session has been started. This behaviour is in contradiction to the docs:

Sessions are automatically started whenever you read, write or even check for the existence of data in the session.

This is because symfony ensures the session has been started on calls to getFlashBag() which is normally how the flashbag will be accessed but this is not called if you inject the FlashBag directly into the container.

I have addressed this issue by changing the way the Flashbag service is built so that it uses Session as a factory service and getFlashBag as a factory method. This means that anywhere in symfony where FlashBag is injected can now rely on the fact the session is started.

I have also added a new functional test to verify this behaviour.

warslett · 2020-03-13T17:57:33Z

src/Symfony/Bundle/FrameworkBundle/Resources/config/session.xml

-        <service id="session.flash_bag" class="Symfony\Component\HttpFoundation\Session\Flash\FlashBag" />
+        <service id="session.flash_bag" class="Symfony\Component\HttpFoundation\Session\Flash\FlashBag">
+            <factory service="session" method="getFlashBag"/>
+        </service>
        <service id="Symfony\Component\HttpFoundation\Session\Flash\FlashBagInterface" alias="session.flash_bag" />

        <service id="session.attribute_bag" class="Symfony\Component\HttpFoundation\Session\Attribute\AttributeBag" />


@nicolas-grekas should we also configure session.attribute_bag in the same way for consistency?

yes that'd make sense

Then on master, we could deprecate these two services.

@warslett up to send a PR to deprecate these?

@nicolas-grekas here: #36273 I get build failures but doesn't seem related. Are the builds on master wonky right now?

fabpot · 2020-03-16T06:35:16Z

Thank you @warslett.

fabpot · 2020-03-16T06:36:07Z

@warslett Can you prepare a PR on master to deprecate the two services as suggested by Nicolas (I've merged 3.4 up to master)?

warslett · 2020-03-16T08:31:25Z

@fabpot sure I can do that this evening. I'll use the message: "The "%service_id%" service is deprecated since Symfony 5.1"

ekosogin · 2020-03-28T11:27:17Z

After this this bug fix new bug was created if session with namespaces was configured

session:
    class: Symfony\Component\HttpFoundation\Session\Session
    arguments:
        - '@session.storage'
        - '@Symfony\Component\HttpFoundation\Session\Attribute\NamespacedAttributeBag'
        - '@session.flash_bag'
Symfony\Component\HttpFoundation\Session\Attribute\NamespacedAttributeBag: ~

Circular reference detected for service "session", path: "session -> session.flash_bag -> session".

warslett · 2020-03-28T13:02:48Z

@ekosogin you don't actually need the @session.flash_bag parameter on there. You should be able to do this:

session:
    class: Symfony\Component\HttpFoundation\Session\Session
    arguments:
        - '@session.storage'
        - '@Symfony\Component\HttpFoundation\Session\Attribute\NamespacedAttributeBag'
Symfony\Component\HttpFoundation\Session\Attribute\NamespacedAttributeBag: ~

warslett · 2020-03-28T14:06:48Z

@fabpot I have a branch with the deprecation on master but haven't created a PR yet (sorry virus got in the way). Do we need to consider @ekosogin's problem first? It is simple enough to remove the session.flash_bag argument from his session definition but if lots of people using symfony have overridden the default session service definition and injected either of these two soon-to-be deprecated services then they might be experiencing the same problem.

ekosogin · 2020-03-28T14:53:51Z

The problem with circular reference still present with this configuration

session:
    class: Symfony\Component\HttpFoundation\Session\Session
    arguments:
        - '@session.storage'
        - '@Symfony\Component\HttpFoundation\Session\Attribute\NamespacedAttributeBag'
Symfony\Component\HttpFoundation\Session\Attribute\NamespacedAttributeBag: ~

nicolas-grekas · 2020-03-30T06:54:04Z

FYI, discussions on closed PRs are like oral talks: we'll all forget about them.

jmalinens · 2020-03-30T06:59:49Z

we have the same issue.

This is the 3rd time in a year where in minor symfony version upgrade breaks something for us in sessions :/

this won't work for us anymore in 4.4.6:

    # Symfony services
    session.flash_bag:
        class: OurCustom\FlashBag

    session.attribute_bag:
        class: Symfony\Component\HttpFoundation\Session\Attribute\NamespacedAttributeBag
        calls:
            - [setName, ["login"]]
        arguments: ['login', '.']

jmalinens · 2020-03-30T07:15:09Z

@nicolas-grekas looks like the ticket is about session flash bag and that' is ok to remove it from Session service definition but

https://github.com/symfony/symfony/pull/36063/files#diff-1777be3d93e71a9295d7fed8ed262c3eL16

but session.attribute_bag is also removed in this PR.

We rely on NamespacedAttributeBag so we store symfony session in non-root namespace.

With this change on: https://github.com/symfony/symfony/blob/v4.4.6/src/Symfony/Component/Security/Http/Firewall/ContextListener.php#L119

symfony ignores our namesapce (login) and because of that can not find symfony session data

nicolas-grekas · 2020-03-30T08:29:46Z

Fixed in #36261
Please abstain from commenting on closed PRs next time, except to tell about the new issue you created to report any regression.

…hen circular refs are detected (nicolas-grekas) This PR was merged into the 3.4 branch. Discussion ---------- [FrameworkBundle] revert to legacy wiring of the session when circular refs are detected | Q | A | ------------- | --- | Branch? | 3.4 | Bug fix? | yes | New feature? | no | Deprecations? | no | Tickets | Fix #36063 | License | MIT | Doc PR | - As introduced and reported in the linked PR. Commits ------- 35644cf [FrameworkBundle] revert to legacy wiring of the session when circular refs are detected

…services (William Arslett) This PR was squashed before being merged into the 5.1-dev branch. Discussion ---------- [FrameworkBundle] Deprecate flashbag and attributebag services | Q | A | ------------- | --- | Branch? | master | Bug fix? | no | New feature? | no | Deprecations? | yes | Tickets | Related to [#10557](#10557) | Related to PR | #36063 | License | MIT FlashBag and AttributeBag are data objects and so should not be available via the service container. The preferred method for accessing these objects is via `$session->getFlashBag()` or `$session->getAttributeBag()` Commits ------- f9b52fe [FrameworkBundle] Deprecate flashbag and attributebag services

…tion (fancyweb) This PR was merged into the 3.4 branch. Discussion ---------- [FrameworkBundle] Fix session.attribute_bag service definition | Q | A | ------------- | --- | Branch? | 3.4 | Bug fix? | yes | New feature? | no | Deprecations? | no | Tickets | #36465 | License | MIT | Doc PR | - It looks like in #36063, the fact the the `getAttributeBag` method is private was forgotten. It cannot be used as the factory method. I guess we can make it public. Should it maybe marked `@internal`? Commits ------- 76072c6 [FrameworkBundle] Fix session.attribute_bag service definition

- FlashBagProvider is not wired in contructor anymore because it had side effects (session was started when the container was built) - see symfony/symfony#36063

carsonbot added Status: Needs Review Bug labels Mar 13, 2020

warslett force-pushed the 33084-start-session-on-flashbag-injection branch from ff4754e to 67d178e Compare March 13, 2020 17:56

warslett commented Mar 13, 2020

View reviewed changes

nicolas-grekas added this to the 3.4 milestone Mar 13, 2020

nicolas-grekas changed the title ~~33084 start session on flashbag injection~~ [FrameworkBundle] start session on flashbag injection Mar 13, 2020

fabpot approved these changes Mar 16, 2020

View reviewed changes

carsonbot added Status: Reviewed and removed Status: Needs Review labels Mar 16, 2020

[FrameworkBundle] start session on flashbag injection

e8b4d35

fabpot force-pushed the 33084-start-session-on-flashbag-injection branch from 8b5cbfd to e8b4d35 Compare March 16, 2020 06:35

fabpot merged commit 78b11a5 into symfony:3.4 Mar 16, 2020

warslett deleted the 33084-start-session-on-flashbag-injection branch March 16, 2020 11:06

This was referenced Mar 27, 2020

Release v4.4.6 #36232

Merged

Release v5.0.6 #36240

Merged

fabpot mentioned this pull request Mar 30, 2020

Release v3.4.39 #36260

Merged

nicolas-grekas mentioned this pull request Mar 30, 2020

[FrameworkBundle] revert to legacy wiring of the session when circular refs are detected #36261

Merged

warslett mentioned this pull request Mar 30, 2020

[FrameworkBundle] Deprecate flashbag and attributebag services #36273

Merged

Plopix mentioned this pull request Apr 1, 2020

[HTTP Cache][Session] Something is odd a behaviour was broken from 4.4.4 to 4.4.7 #36296

Closed

warslett mentioned this pull request Apr 4, 2020

[5.0][HttpFoundation] The session must not be a service #10557

Closed

dannyvw mentioned this pull request Apr 6, 2020

[NodeBundle] Use flashbag from session Kunstmaan/KunstmaanBundlesCMS#2661

Merged

emodric mentioned this pull request Apr 7, 2020

Reset the session key for session attributes to a default Symfony value ezsystems/LegacyBridge#178

Merged

fancyweb mentioned this pull request Apr 20, 2020

[FrameworkBundle] Fix session.attribute_bag service definition #36506

Merged

iteman mentioned this pull request Jun 17, 2020

The new 'session' service definition support on Symfony 3.4.3 or later phpmentors-jp/pageflower-bundle#13

Merged

vitek-rostislav mentioned this pull request Jul 26, 2022

[frontend-api] avoid session starting in FE API shopsys/shopsys#2497

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[FrameworkBundle] start session on flashbag injection #36063

[FrameworkBundle] start session on flashbag injection #36063

warslett commented Mar 13, 2020

warslett Mar 13, 2020

nicolas-grekas Mar 13, 2020

nicolas-grekas Mar 13, 2020

nicolas-grekas Mar 30, 2020

warslett Mar 30, 2020

fabpot commented Mar 16, 2020

fabpot commented Mar 16, 2020

warslett commented Mar 16, 2020

ekosogin commented Mar 28, 2020

warslett commented Mar 28, 2020

warslett commented Mar 28, 2020

ekosogin commented Mar 28, 2020

nicolas-grekas commented Mar 30, 2020 •

edited

Loading

jmalinens commented Mar 30, 2020 •

edited

Loading

jmalinens commented Mar 30, 2020

nicolas-grekas commented Mar 30, 2020

[FrameworkBundle] start session on flashbag injection #36063

[FrameworkBundle] start session on flashbag injection #36063

Conversation

warslett commented Mar 13, 2020

warslett Mar 13, 2020

Choose a reason for hiding this comment

nicolas-grekas Mar 13, 2020

Choose a reason for hiding this comment

nicolas-grekas Mar 13, 2020

Choose a reason for hiding this comment

nicolas-grekas Mar 30, 2020

Choose a reason for hiding this comment

warslett Mar 30, 2020

Choose a reason for hiding this comment

fabpot commented Mar 16, 2020

fabpot commented Mar 16, 2020

warslett commented Mar 16, 2020

ekosogin commented Mar 28, 2020

warslett commented Mar 28, 2020

warslett commented Mar 28, 2020

ekosogin commented Mar 28, 2020

nicolas-grekas commented Mar 30, 2020 • edited Loading

jmalinens commented Mar 30, 2020 • edited Loading

jmalinens commented Mar 30, 2020

nicolas-grekas commented Mar 30, 2020

nicolas-grekas commented Mar 30, 2020 •

edited

Loading

jmalinens commented Mar 30, 2020 •

edited

Loading