mezzio / mezzio-authentication-session Goto Github PK

There is a problem with the user factory closure:

https://github.com/zendframework/zend-expressive-authentication-session/blob/93ba0968a4118bc1800a43e93fbfd6ef79ac12d9/src/PhpSession.php#L63-L69

When a user doesn't exist anymore in the repository, the user factory should be able to return null. Right now aTypeError is thrown.

Originally posted by @thomasvargiu at zendframework/zend-expressive-authentication-session#23

Slight bug in the documentation for the LoginHandler example, specifically with the getRedirect() function. There is a chance of returning the Uri object instead of a string.

The final return statement return $redirect; should be cast to string,return (string)$redirect; to ensure a string is returned and not the actual Uri object.

When a user is authenticated both her/his identity and roles are stored in the session. Subsequent requests will check for any active session first, so, even if the user was deleted or updated with more restricted roles, as long as the session stays active, the user can operate with old permissions (the user snapshot at login time) (Think of a rude forum member)

Sessions can also survive browser close/reopen operation if the browser is configured to remember session cookies when the session lifetime is not set to be very short.

I have always used a different approach: I store just the identity (id/username/email) of the user in the session and reload the user details/permission from the storage (db) on every request.

kind regards

Feature Request

Summary

To be prepared for the december release of PHP 8.0, this repository has some additional TODOs to be tested against the new major version.

In order to make this repository compatible, one has to follow these steps:

• Modify composer.json to provide support for PHP 8.0 by adding the constraint ~8.0.0
• Modify composer.json to drop support for PHP less than 7.3
• Modify composer.json to implement phpunit 9.3 which supports PHP 7.3+
• Modify .travis.yml to ignore platform requirements when installing composer dependencies (simply add --ignore-platform-reqs to COMPOSER_ARGS env variable)
• Modify .travis.yml to add PHP 8.0 to the matrix (NOTE: Do not allow failures as PHP 8.0 has a feature freeze since 2020-08-04!)
• Modify source code in case there are incompatibilities with PHP 8.0

As requested in #19 here is my current login workflow.

I've laid out all the related code in this gist

I'm not sure how to present an alternative workflow in the documentation therefor I'm starting this discussion to figure out the how's and where's. If you want take the code and incorporate it into the documentation yourselves then that's fine too, I'm not much of a documentation guy 😄

Originally posted by @jonsa at zendframework/zend-expressive-authentication-session#20

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• Update dependency phpunit/phpunit to v11
• Lock file maintenance

Detected dependencies

• Check this box to trigger a request for Renovate to run again on this repository

Switch from Travis-CI to GHA CI workflow, as documented at https://gist.github.com/weierophinney/b003e50c3c2667d08076caf31ebd36a4

Feature Request

Summary

As decided during the Technical-Steering-Committee Meeting on August 3rd, 2020, Laminas wants to implement vimeo/psalm in all packages.

Implementing psalm is quite easy.

Required

• Create a psalm.xml in the project root
• Copy and paste the contents from this psalm.xml.dist
• Run $ composer require --dev vimeo/psalm
• Run $ vendor/bin/psalm --set-baseline=psalm-baseline.xml
• Add a composer script static-analysis with the command psalm --shepherd --stats
• Add a new line to script: in .travis.yml: - if [[ $TEST_COVERAGE == 'true' ]]; then composer static-analysis ; fi
• Remove phpstan from the project (phpstan.neon.dist, .travis.yml entry, composer.json require-dev and scripts)

Optional

• Fix as many psalm errors as possible.