Detailed explanation of Sessionid processing mechanism in Laravel

This article mainly introduces you to the relevant information about the Sessionid processing mechanism in Laravel. The article introduces it in great detail through sample code. It has certain reference learning value for everyone's study or work. Friends who need it follow the editor below. Come and learn together. I hope to be helpful.

Preface

This article mainly introduces to you the relevant content about the Sessionid processing mechanism in Laravel, and shares it for your reference and study. The following words Not much more to say, let’s take a look at the detailed introduction.

Session Cookie Name can be set in Laravel's configuration file config/session.php. For example, in this project, the name is set to "sns_session":

/*
|--------------------------------------------------------------------------
| Session Cookie Name
|--------------------------------------------------------------------------
|
| Here you may change the name of the cookie used to identify a session
| instance by ID. The name specified here will get used every time a
| new session cookie is created by the framework for every driver.
|
*/
 
'cookie' => 'sns_session',

We can see refresh the page and view the cookie , you will find a cookie named sns_session, the name is our custom one.

This sessionid is the bridge between cookie and session. The server uses this sessionid to determine which client the request comes from.

Laravel's sessionid changes every time it is refreshed

However, every time the page is refreshed, this cookie value will change! So how does the server maintain the session? Because your sessionid is always changing.

Laravel encrypts cookies

We are in vendor/laravel/framework/src/Illuminate/ Debug in the save method of Session/Store.php and print the call stack here:

/**
 * {@inheritdoc}
 */
public function save()
{
 $this->addBagDataToSession();
 
 $this->ageFlashData();
 
 $this->handler->write($this->getId(), $this->prepareForStorage(serialize($this->attributes)));
 
 $this->started = false;
 
 dd(debug_backtrace(DEBUG_BACKTRACE_PROVIDE_OBJECT,5));
}

Every time the page is refreshed, the id attribute of the Store object does not actually change. This attribute is the sessionid cookie. value. In other words, the value of sessionid does not change every time, but when the cookie is written, the value changes.

The reason was found in the encrypt method in vendor/laravel/framework/src/Illuminate/Cookie/Middleware/EncryptCookies.php. This middleware encrypts all cookie values. Encryption handling, it is included in the web middleware.

protected function encrypt(Response $response)
{
 foreach ($response->headers->getCookies() as $cookie) {
 if ($this->isDisabled($cookie->getName())) {
  continue;
 }
 
 $response->headers->setCookie($this->duplicate(
  $cookie, $this->encrypter->encrypt($cookie->getValue())
 ));
 }
 return $response;
}

This encryption method results in different encryption results every time, so it appears that the value of sessionid has changed every time, but in fact it has not changed. This cookie will be decrypted when it is needed.

The purpose of this design of the Laravel framework may be to prevent session hijacking! Consideration is quite comprehensive!

Other supplementary knowledge

Native PHP setting session name

session_name() function:

<?php
 
/* 设置会话名称为 WebsiteID */
 
$previous_name = session_name("WebsiteID");
 
echo "The previous session name was $previous_name<br />";
?>

session_name() The function returns the current session name. If the name parameter is specified, the session_name() function will update the session name and return the original session name.

When the request starts, the session name will be reset and stored in the session.name configuration item. Therefore, to set the session name, for each request, the session_name() function needs to be called before calling the session_start() or session_register() function. .

The difference and relationship between COOKIE and SESSION

• ##COOKIE is saved on the client side, while SESSION is saved on the server side

• In terms of security, SESSION is more secure

• From the perspective of the type of content saved, COOKIE only saves characters String (and can be automatically converted into a string)

• From the perspective of the size of the saved content, the content saved by COOKIE is limited and relatively small, while SESSION basically does not have this limitation

• From a performance perspective, using SESSION will put more pressure on the server

• SEEION depends on COOKIE, but if COOKIE is disabled , you can also pass it through the url

Related recommendations:

Explain how to customize encryption in laravel Service

Laravel optimized split routing file

laravel writing APP interface (API)

The above is the detailed content of Detailed explanation of Sessionid processing mechanism in Laravel. For more information, please follow other related articles on the PHP Chinese website!