Loading...

XML

Word

Printable

Details

Type: Bug
Resolution: Fixed
Priority: High
Fix Version/s: Customer request, 2014.07, 5.3.3
Affects Version/s: 2014.05, 5.3.2
Component/s: Platform stack, Users and Access control
Labels:
- legacy
- security
- session

Description

As of 5.3 / 2014.03, sessions are supposed to be lazy again, managed by Symfony. This was made possible by handling user authentication by Symfony security component.
However, accessing an eZ 5.3 website (frontend) will always start a session (and send a session cookie if one does not yet exist), even for anonymous users.

Culprit is eZ\Bundle\EzPublishLegacyBundle\LegacyMapper\Security::onKernelBuilt(). It indeed injects any user authenticated in the Repository in the legacy kernel, using eZUser::setLoggedInUser(), which triggers session start.

Steps to reproduce:

> curl -I http://ezp53.local/

HTTP/1.1 200 OK
Date: Wed, 16 Jul 2014 19:04:59 GMT
Server: Apache/2.2.22 (Ubuntu)
X-Powered-By: PHP/5.4.30-2+deb.sury.org <http://deb.sury.org>~__precise+1
Set-Cookie: eZSESSID=__fdtp4lbsnd59v9rnccgs6cgnj0; path=/

Attachments

Issue Links

relates to

EZP-23027 Session files not being removed/cleaned up

Closed

EZP-23683 Symfony starts always a session on legacy_mode

Closed

EZP-23291 Login screen creates a session even if Lazy sessions are set

Confirmed

links to

Activity

People

Assignee:: Unassigned

Reporter:: Joao Inacio (Inactive)

Votes:: 0 Vote for this issue

Watchers:: 5 Start watching this issue

Dates

Created:: 18/Jul/14 3:17 PM

Updated:: 25/Nov/14 5:42 PM

Resolved:: 25/Jul/14 10:37 AM

Time Tracking

Estimated:

Not Specified

Remaining:

Logged: