function SessionTest::testEmptySessionID

Tests that empty session IDs are not allowed.

File

core/modules/system/tests/src/Functional/Session/SessionTest.php, line 301

Class

SessionTest

Drupal session handling tests.

Namespace

Code

public function testEmptySessionID() : void {
    $user = $this->drupalCreateUser([]);
    $this->drupalLogin($user);
    $this->drupalGet('session-test/is-logged-in');
    $this->assertSession()
        ->statusCodeEquals(200);
    // Reset the sid in {sessions} to a blank string. This may exist in the
    // wild in some cases, although we normally prevent it from happening.
    Database::getConnection()->update('sessions')
        ->fields([
        'sid' => '',
    ])
        ->condition('uid', $user->id())
        ->execute();
    // Send a blank sid in the session cookie, and the session should no longer
    // be valid. Closing the curl handler will stop the previous session ID
    // from persisting.
    $this->mink
        ->resetSessions();
    $this->drupalGet('session-test/id-from-cookie');
    // Verify that session ID is blank as sent from cookie header.
    $this->assertSession()
        ->responseContains("session_id:\n");
    // Assert that we have an anonymous session now.
    $this->drupalGet('session-test/is-logged-in');
    $this->assertSession()
        ->statusCodeEquals(403);
}