Add session hijacking mitigation configuration

[Slamdunk]

No description provided.

[Slamdunk]

Cmon @Ocramius

[Slamdunk]

Ping @Ocramius

[Ocramius]

Overall, patch direction improved massively.

My feedback is mostly highlighting problems without proposing real alternatives at the moment, since I mostly focused on providing some feedback at first.

I believe we can discuss this on a call again, but the fact that most validation is now handled inside lcobuccci/jwt is really good.

Things I don't like:

• current ergonomics and docs (mostly, because we're uncovering issues due to lack of a config builder)
• introduction of sodium_ stuff that we'll have to maintain, where a simple sha1 is already effective
• reliance on $_SERVER where reading a header would be preferable
• reliance on REMOTE_ADDR where unreliable

[Ocramius]

This interface requires some documentation: taken as-is, it is not very clear what it does.

Also, could it be that it cannot extract information from $request?

[Ocramius]

There is a problem with relying on REMOTE_ADDR: it does not consider any proxies. If we assume that there's an upfront middleware that clears all this information, that's fine, but this Source is unreliable when the middleware is deployed independently, and put behind a reverse proxy.

[Slamdunk]

The only thing this library can do about that is documentation:
https://github.com/psr7-sessions/storageless/tree/9.0.x#session-hijacking-mitigation

[Slamdunk]

@Ocramius sorry to bother you: we really need this feature. I've opened #570 to address many of the review comments you've given here, but I didn't see any reply here nor there.

If you don't have time anymore, I propose myself as a Collaborator for this package to evolve and maintain it.

[Ocramius]

Done :-)