function SessionTest::testSessionSaveRegenerate

Tests session writing and regeneration.

@covers \Drupal\Core\Session\WriteSafeSessionHandler::setSessionWritable @covers \Drupal\Core\Session\WriteSafeSessionHandler::isSessionWritable @covers \Drupal\Core\Session\SessionManager::regenerate

File

core/modules/system/tests/src/Functional/Session/SessionTest.php, line 34

Class

SessionTest

Drupal session handling tests.

Namespace

Code

public function testSessionSaveRegenerate() : void {
    $session_handler = $this->container
        ->get('session_handler.write_safe');
    $this->assertTrue($session_handler->isSessionWritable(), 'session_handler->isSessionWritable() initially returns TRUE.');
    $session_handler->setSessionWritable(FALSE);
    $this->assertFalse($session_handler->isSessionWritable(), '$session_handler->isSessionWritable() returns FALSE after disabling.');
    $session_handler->setSessionWritable(TRUE);
    $this->assertTrue($session_handler->isSessionWritable(), '$session_handler->isSessionWritable() returns TRUE after enabling.');
    // Test session hardening code from SA-2008-044.
    $user = $this->drupalCreateUser();
    // Enable sessions.
    $this->sessionReset();
    // Make sure the session cookie is set as HttpOnly. We can only test this in
    // the header, with the test setup
    // \GuzzleHttp\Cookie\SetCookie::getHttpOnly() always returns FALSE.
    // Start a new session by setting a message.
    $this->drupalGet('session-test/set-message');
    $this->assertSessionCookie(TRUE);
    // Verify that the session cookie is set as HttpOnly.
    $this->assertSession()
        ->responseHeaderMatches('Set-Cookie', '/HttpOnly/i');
    // Verify that the session is regenerated if a module calls exit
    // in hook_user_login().
    $user->name = 'session_test_user';
    $user->save();
    $this->drupalGet('session-test/id');
    $matches = [];
    preg_match('/\\s*session_id:(.*)\\n/', $this->getSession()
        ->getPage()
        ->getContent(), $matches);
    $this->assertNotEmpty($matches[1], 'Found session ID before logging in.');
    $original_session = $matches[1];
    // We cannot use $this->drupalLogin($user); because we exit in
    // session_test_user_login() which breaks a normal assertion.
    $edit = [
        'name' => $user->getAccountName(),
        'pass' => $user->passRaw,
    ];
    $this->drupalGet('user/login');
    $this->submitForm($edit, 'Log in');
    $this->drupalGet('user');
    $this->assertSession()
        ->pageTextContains($user->getAccountName());
    $this->drupalGet('session-test/id');
    $matches = [];
    preg_match('/\\s*session_id:(.*)\\n/', $this->getSession()
        ->getPage()
        ->getContent(), $matches);
    $this->assertNotEmpty($matches[1], 'Found session ID after logging in.');
    $this->assertNotSame($original_session, $matches[1], 'Session ID changed after login.');
}