Skip to content

Commit

Permalink
Update session key generation in SessionStorage
Browse files Browse the repository at this point in the history
This commit changes how session keys are generated in SessionStorage. Instead of using a static value, a hash of the item's public key credential challenge is added to the session parameter to create a unique key. This enhancement should improve session data security.
  • Loading branch information
Spomky committed Jul 12, 2024
1 parent 1aa51a6 commit 5b1db1e
Showing 1 changed file with 5 additions and 1 deletion.
6 changes: 5 additions & 1 deletion src/symfony/src/Security/Storage/SessionStorage.php
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,11 @@ public function __construct(
public function store(Item $item, string|null $tag = null): void
{
$session = $this->requestStack->getSession();
$key = sprintf('%s-%s', self::SESSION_PARAMETER, hash('xxh128', $item->getPublicKeyCredentialOptions()->challenge));
$key = sprintf(
'%s-%s',
self::SESSION_PARAMETER,
hash('xxh128', $item->getPublicKeyCredentialOptions()->challenge)
);
$session->set($key, [
'options' => $item->getPublicKeyCredentialOptions(),
'userEntity' => $item->getPublicKeyCredentialUserEntity(),
Expand Down

0 comments on commit 5b1db1e

Please sign in to comment.