Skip to content

Commit

Permalink
Update session key generation in SessionStorage
Browse files Browse the repository at this point in the history
This commit changes how session keys are generated in SessionStorage. Instead of using a static value, a hash of the item's public key credential challenge is added to the session parameter to create a unique key. This enhancement should improve session data security.
  • Loading branch information
Spomky committed Jul 12, 2024
1 parent fd8af8f commit 1aa51a6
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion src/symfony/src/Security/Storage/SessionStorage.php
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,8 @@ public function __construct(
public function store(Item $item, string|null $tag = null): void
{
$session = $this->requestStack->getSession();
$session->set(self::SESSION_PARAMETER, [
$key = sprintf('%s-%s', self::SESSION_PARAMETER, hash('xxh128', $item->getPublicKeyCredentialOptions()->challenge));
$session->set($key, [
'options' => $item->getPublicKeyCredentialOptions(),
'userEntity' => $item->getPublicKeyCredentialUserEntity(),
]);
Expand Down

0 comments on commit 1aa51a6

Please sign in to comment.