Last Updated: February 25, 2016
·
1.02K
· khaitu

Symfony2 API Cookie Removal

The Symfony2 framework doesn't allow simple disabling of the PHPSESSID cookie as this is hardcoded into the framework itself, and overrides any PHP config you may have either in the php.ini file or an .htaccess file.

In order to remove the cookie, it is necessary to override the default session storage handler.

<?php

namespace Insead\MIMBundle\Service\Session;

use Symfony\Component\DependencyInjection\ContainerInterface;
use Symfony\Component\HttpFoundation\Session\Storage\NativeSessionStorage;

class Storage extends NativeSessionStorage
{
    public function __construct(array $options = array(), $handler = null, MetadataBag $metaBag = null)
    {
        session_cache_limiter(''); // disable by default because it's managed by HeaderBag (if used)
        ini_set('session.use_cookies', 0);

        if (PHP_VERSION_ID >= 50400) {
            session_register_shutdown();
        } else {
            register_shutdown_function('session_write_close');
        }

        $this->setMetadataBag($metaBag);
        $this->setOptions($options);
        $this->setSaveHandler($handler);
    }
}

Have a fresh tip? Share with Coderwall community!

Post
Post a tip
Related Tags
#php
#symfony2
Did you know?

PHP applications still send a browser full of JavaScript. Hardening the server does not inventory the payment, analytics, and plugin scripts that run after the HTML is delivered.

Security insights from Cside