symfony · ajgarlag · Dec 2, 2014 · Dec 2, 2014 · Dec 2, 2014 · Dec 2, 2014
diff --git a/src/Symfony/Bundle/SecurityBundle/DependencyInjection/MainConfiguration.php b/src/Symfony/Bundle/SecurityBundle/DependencyInjection/MainConfiguration.php
@@ -277,6 +277,13 @@ private function addFirewallsSection(ArrayNodeDefinition $rootNode, array $facto
                     ->scalarNode('role')->defaultValue('ROLE_ALLOWED_TO_SWITCH')->end()
                 ->end()
             ->end()
+            ->arrayNode('session_expiration')
+                ->canBeUnset()
+                ->children()
+                    ->integerNode('max_idle_time')->defaultValue(ini_get('session.gc_maxlifetime'))->min(1)->end()
+                    ->scalarNode('expiration_url')->defaultNull()->end()
+                ->end()
+            ->end()
         ;
 
         $abstractFactoryKeys = array();

diff --git a/src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php b/src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php
@@ -370,6 +370,11 @@ private function createFirewall(ContainerBuilder $container, $id, $firewall, &$a
             $listeners[] = new Reference($this->createSwitchUserListener($container, $id, $firewall['switch_user'], $defaultProvider));
         }
 
+        // Session expiration listener
+        if (isset($firewall['session_expiration'])) {
+            $listeners[] = new Reference($this->createSessionExpirationListener($container, $id, $firewall));
+        }
+
         // Access listener
         $listeners[] = new Reference('security.access_listener');
 
@@ -594,6 +599,17 @@ private function createSwitchUserListener($container, $id, $config, $defaultProv
         return $switchUserListenerId;
     }
 
+    private function createSessionExpirationListener($container, $id, $config)
+    {
+        $expiredSessionListenerId = 'security.authentication.session_expiration_listener.'.$id;
+        $listener = $container->setDefinition($expiredSessionListenerId, new DefinitionDecorator('security.authentication.session_expiration_listener'));
+
+        $listener->replaceArgument(2, $config['session_expiration']['max_idle_time']);
+        $listener->replaceArgument(3, $config['session_expiration']['expiration_url']);
+
+        return $expiredSessionListenerId;
+    }
+
     private function createExpression($container, $expression)
     {
         if (isset($this->expressions[$id = 'security.expression.'.sha1($expression)])) {

diff --git a/src/Symfony/Bundle/SecurityBundle/Resources/config/security_listeners.xml b/src/Symfony/Bundle/SecurityBundle/Resources/config/security_listeners.xml
@@ -225,6 +225,15 @@
             <argument type="service" id="event_dispatcher" on-invalid="null"/>
         </service>
 
+        <service id="security.authentication.session_expiration_listener" class="Symfony\Component\Security\Http\Firewall\SessionExpirationListener" public="false" abstract="true">
+            <tag name="monolog.logger" channel="security" />
+            <argument type="service" id="security.token_storage" />
+            <argument type="service" id="security.http_utils" />
+            <argument /> <!-- Max idle time -->
+            <argument /> <!-- Target-URL -->
+            <argument type="service" id="logger" on-invalid="null" />
+        </service>
+
         <service id="security.access_listener" class="Symfony\Component\Security\Http\Firewall\AccessListener" public="false">
             <tag name="monolog.logger" channel="security" />
             <argument type="service" id="security.token_storage" />

diff --git a/...dle/Tests/Functional/Bundle/SimpleLoginBundle/Resources/views/Login/after_login.html.twig b/...dle/Tests/Functional/Bundle/SimpleLoginBundle/Resources/views/Login/after_login.html.twig
@@ -0,0 +1,7 @@
+{% extends "::base.html.twig" %}
+
+{% block body %}
+    Hello {{ user.username }}!<br /><br />
+    You're browsing to path "{{ app.request.pathInfo }}".
+
+{% endblock %}
diff --git a/...ony/Bundle/SecurityBundle/Tests/Functional/Bundle/SimpleLoginBundle/SimpleLoginBundle.php b/...ony/Bundle/SecurityBundle/Tests/Functional/Bundle/SimpleLoginBundle/SimpleLoginBundle.php
@@ -0,0 +1,22 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Bundle\SecurityBundle\Tests\Functional\Bundle\SimpleLoginBundle;
+
+use Symfony\Component\HttpKernel\Bundle\Bundle;
+
+class SimpleLoginBundle extends Bundle
+{
+    public function getParent()
+    {
+        return 'FormLoginBundle';
+    }
+}
diff --git a/src/Symfony/Bundle/SecurityBundle/Tests/Functional/SessionExpirationTest.php b/src/Symfony/Bundle/SecurityBundle/Tests/Functional/SessionExpirationTest.php
@@ -0,0 +1,53 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Bundle\SecurityBundle\Tests\Functional;
+
+use Symfony\Bridge\PhpUnit\ClockMock;
+use Symfony\Component\Security\Http\Firewall\SessionExpirationListener;
+
+/**
+ * @group functional
+ * @group time-sensitive
+ */
+class SessionExpirationTest extends WebTestCase
+{
+    protected function setUp()
+    {
+        parent::setUp();
+
+        ClockMock::register(SessionExpirationListener::class);
+    }
+
+    public function testExpiredExceptionRedirectsToTargetUrl()
+    {
+        $client = $this->createClient(array('test_case' => 'SessionExpiration', 'root_config' => 'config.yml'));
+        $form = $client->request('GET', '/login')->selectButton('login')->form();
+        $form['_username'] = 'antonio';
+        $form['_password'] = 'secret';
+        $client->submit($form);
+        $this->assertRedirect($client->getResponse(), '/profile');
+
+        $client->request('GET', '/protected_resource');
+        $this->assertEquals(200, $client->getResponse()->getStatusCode());
+
+        sleep(5); //Wait for session to expire
+        $client->request('GET', '/protected_resource');
+        $this->assertRedirect($client->getResponse(), '/expired');
+    }
+
+    protected function tearDown()
+    {
+        $this->deleteTmpDir('SessionExpiration');
+
+        parent::tearDown();
+    }
+}
diff --git a/src/Symfony/Bundle/SecurityBundle/Tests/Functional/app/SessionExpiration/bundles.php b/src/Symfony/Bundle/SecurityBundle/Tests/Functional/app/SessionExpiration/bundles.php
@@ -0,0 +1,15 @@
+<?php
+
+use Symfony\Bundle\SecurityBundle\Tests\Functional\Bundle\FormLoginBundle\FormLoginBundle;
+use Symfony\Bundle\SecurityBundle\Tests\Functional\Bundle\SimpleLoginBundle\SimpleLoginBundle;
+use Symfony\Bundle\TwigBundle\TwigBundle;
+use Symfony\Bundle\SecurityBundle\SecurityBundle;
+use Symfony\Bundle\FrameworkBundle\FrameworkBundle;
+
+return array(
+    new FrameworkBundle(),
+    new SecurityBundle(),
+    new TwigBundle(),
+    new FormLoginBundle(),
+    new SimpleLoginBundle(),
+);
diff --git a/src/Symfony/Bundle/SecurityBundle/Tests/Functional/app/SessionExpiration/config.yml b/src/Symfony/Bundle/SecurityBundle/Tests/Functional/app/SessionExpiration/config.yml
@@ -0,0 +1,32 @@
+imports:
+    - { resource: ./../config/default.yml }
+
+security:
+    encoders:
+        Symfony\Component\Security\Core\User\User: plaintext
+
+    providers:
+        in_memory:
+            memory:
+                users:
+                    antonio: { password: secret, roles: [ROLE_USER] }
+
+    firewalls:
+        # This firewall doesn't make sense in combination with the rest of the
+        # configuration file, but it's here for testing purposes (do not use
+        # this file in a real world scenario though)
+        login_form:
+            pattern: ^/login$
+            security: false
+
+        default:
+            form_login:
+                check_path: /login_check
+                default_target_path: /profile
+            anonymous: ~
+            session_expiration:
+                max_idle_time: 1
+                expiration_url: /expired
+
+    access_control:
+        - { path: .*, roles: IS_AUTHENTICATED_FULLY }
diff --git a/src/Symfony/Bundle/SecurityBundle/Tests/Functional/app/SessionExpiration/routing.yml b/src/Symfony/Bundle/SecurityBundle/Tests/Functional/app/SessionExpiration/routing.yml
@@ -0,0 +1,2 @@
+_form_login_bundle:
+    resource: '@FormLoginBundle/Resources/config/routing.yml'
diff --git a/src/Symfony/Bundle/SecurityBundle/composer.json b/src/Symfony/Bundle/SecurityBundle/composer.json
@@ -17,7 +17,7 @@
     ],
     "require": {
         "php": ">=5.5.9",
-        "symfony/security": "~3.1,>=3.1.2",
+        "symfony/security": "~3.2",
         "symfony/http-kernel": "~3.1",
         "symfony/polyfill-php70": "~1.0"
     },

diff --git a/src/Symfony/Component/Security/Core/Exception/SessionExpiredException.php b/src/Symfony/Component/Security/Core/Exception/SessionExpiredException.php
@@ -0,0 +1,28 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\Exception;
+
+/**
+ * SessionExpiredException is thrown when session has been idle for a long time.
+ *
+ * @author Antonio J. García Lagar <aj@garcialagar.es>
+ */
+class SessionExpiredException extends AuthenticationException
+{
+    /**
+     * {@inheritdoc}
+     */
+    public function getMessageKey()
+    {
+        return 'Session has expired.';
+    }
+}
diff --git a/src/Symfony/Component/Security/Core/Resources/translations/security.en.xlf b/src/Symfony/Component/Security/Core/Resources/translations/security.en.xlf
@@ -66,6 +66,10 @@
                 <source>Account is locked.</source>
                 <target>Account is locked.</target>
             </trans-unit>
+            <trans-unit id="17">
+                <source>Session has expired.</source>
+                <target>Session has expired.</target>
+            </trans-unit>
         </body>
     </file>
 </xliff>
diff --git a/src/Symfony/Component/Security/Core/Resources/translations/security.es.xlf b/src/Symfony/Component/Security/Core/Resources/translations/security.es.xlf
@@ -66,6 +66,10 @@
                 <source>Account is locked.</source>
                 <target>La cuenta está bloqueada.</target>
             </trans-unit>
+            <trans-unit id="17">
+                <source>Session has expired.</source>
+                <target>La sesión ha expirado.</target>
+            </trans-unit>
         </body>
     </file>
 </xliff>
diff --git a/src/Symfony/Component/Security/Http/Firewall/SessionExpirationListener.php b/src/Symfony/Component/Security/Http/Firewall/SessionExpirationListener.php
@@ -0,0 +1,100 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Http\Firewall;
+
+use Psr\Log\LoggerInterface;
+use Symfony\Component\HttpKernel\Event\GetResponseEvent;
+use Symfony\Component\Security\Core\Exception\SessionExpiredException;
+use Symfony\Component\Security\Http\HttpUtils;
+use Symfony\Component\HttpFoundation\Session\SessionInterface;
+use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
+
+/**
+ * SessionExpirationListener controls idle sessions.
+ *
+ * @author Antonio J. García Lagar <aj@garcialagar.es>
+ */
+class SessionExpirationListener implements ListenerInterface
+{
+    private $tokenStorage;
+    private $httpUtils;
+    private $maxIdleTime;
+    private $targetUrl;
+    private $logger;
+
+    public function __construct(TokenStorageInterface $tokenStorage, HttpUtils $httpUtils, $maxIdleTime, $targetUrl = null, LoggerInterface $logger = null)
+    {
+        $this->tokenStorage = $tokenStorage;
+        $this->httpUtils = $httpUtils;
+        $this->setMaxIdleTime($maxIdleTime);
+        $this->targetUrl = $targetUrl;
+        $this->logger = $logger;
+    }
+
+    /**
+     * Handles expired sessions.
+     *
+     * @param GetResponseEvent $event A GetResponseEvent instance
+     *
+     * @throws SessionExpiredException If the session has expired
+     */
+    public function handle(GetResponseEvent $event)
+    {
+        $request = $event->getRequest();
+        $session = $request->getSession();
+
+        if (null === $session || null === $token = $this->tokenStorage->getToken()) {
+            return;
+        }
+
+        if (!$this->hasSessionExpired($session)) {
+            return;
+        }
+
+        if (null !== $this->logger) {
+            $this->logger->info(sprintf("Expired session detected for user named '%s'", $token->getUsername()));
+        }
+
+        $this->tokenStorage->setToken(null);
+        $session->invalidate();
+
+        if (null === $this->targetUrl) {
+            throw new SessionExpiredException();
+        }
+
+        $response = $this->httpUtils->createRedirectResponse($request, $this->targetUrl);
+        $event->setResponse($response);
+    }
+
+    /**
+     * @param int $maxIdleTime
+     */
+    private function setMaxIdleTime($maxIdleTime)
+    {
+        if ($maxIdleTime > ini_get('session.gc_maxlifetime') && null !== $this->logger) {
+            $this->logger->warning("Max idle time should not be greater than 'session.gc_maxlifetime'");
+        }
+        $this->maxIdleTime = (int) $maxIdleTime;
+    }
+
+    /**
+     * Checks if the given session has expired.
+     *
+     * @param SessionInterface $session
+     *
+     * @return bool
+     */
+    private function hasSessionExpired(SessionInterface $session)
+    {
+        return time() - $session->getMetadataBag()->getLastUsed() >= $this->maxIdleTime;
+    }
+}
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		_form_login_bundle:
		resource: '@FormLoginBundle/Resources/config/routing.yml'