daravel_session library

Laravel-compatible sessions for Daravel: the sessions table and file format, encrypted cookies and CSRF protection, so a Laravel application and a Daravel application with the same APP_KEY and store share a visitor's session.

Application.configure(basePath: '.')
    .withSession()
    .withMigrations(const [CreateSessionsTable()])
    .withRouting(web: (r) => r.group((r) {...}, middleware: ['web']))

Classes

ArraySessionHandler

Sessions in this isolate's memory: tests and tools. Laravel's array driver, which likewise forgets everything when the process ends.

CookieValuePrefix

Laravel's CookieValuePrefix: an encrypted cookie's clear text starts with hmac_sha1(name . 'v2', key) in hex and |, so a cookie cannot be moved to another name.

CreateSessionsTable

Laravel's sessions table (laravel/laravel 0001_01_01_000000_create_users_table, which creates it next to users): id, user_id, ip_address, user_agent, payload, last_activity. It creates nothing when the table exists already, since a Laravel application's own migration then owns it.

DatabaseSessionHandler

Laravel's sessions table (id, user_id, ip_address, user_agent, payload, last_activity): the payload is the serialize() text in base64 and last_activity a Unix timestamp, so a Laravel application on the same database shares the sessions.

EncryptCookiesMiddleware

Encrypts every cookie the response sets and decrypts the ones the request carries (Laravel's EncryptCookies, with Crypt and CookieValuePrefix), so a Laravel application with the same APP_KEY reads and writes the same cookies. A cookie that does not decrypt, or was made for another name, is dropped from the request. except names cookies left in clear.

FileSessionHandler

One file per session under storage/framework/sessions, named by the id and holding the serialize() payload: Laravel's file driver, so both frameworks on one machine can read each other's files. Expiry is the file's modification time (wall clock, as Laravel reads it).

Session

One request's session (Laravel's Illuminate\Session\Store): a map of attributes loaded from a SessionHandler at the start of the request and written back at its end, so a Laravel application sharing the store reads the same session.

SessionConfig

SESSION_* settings (Laravel's config/session.php).

SessionGuard<T extends Authenticatable>

Laravel's SessionGuard: the user id lives in the session under the same login_web_<sha1> key, so a user logged in on either side of a shared store is logged in on both.

SessionHandler

Where sessions are kept (PHP's SessionHandlerInterface, as Laravel's handlers implement it). read returns the serialized payload, or null for a missing or expired session.

SessionManager

Builds the SessionHandler of the configured driver and a Session per request (Laravel's SessionManager).

StartSessionMiddleware

Starts the session for a request and saves it after the response (Laravel's StartSession): the id comes from the session cookie (decrypted by EncryptCookiesMiddleware when that runs first), the attributes from the handler; the response gets the cookie back, the previous URL is recorded for GET page requests, and 2 requests in 100 sweep expired sessions.

VerifyCsrfTokenMiddleware

Laravel's VerifyCsrfToken: a POST, PUT, PATCH or DELETE request must carry the session's token as the _token input, the X-CSRF-TOKEN header or the X-XSRF-TOKEN header (the encrypted XSRF-TOKEN cookie, which this middleware sets on every response so Axios and Angular send it back). except lists paths that skip the check ('webhooks/*'). Needs StartSessionMiddleware before it.

Extensions

RequestSession on Request

request.session: the session started by StartSessionMiddleware.

SessionApplicationBuilder on ApplicationBuilder

withSession() on the application builder.

SessionAuthManager on AuthManager

auth.session<User>('web', provider) in withAuth.

Functions

redirectInvalidRequest(ValidationException error, Request request) → Future<Response?>

Handler::invalid(): a browser or an Inertia visit goes back with the errors and its input flashed. Clients expecting JSON, and requests without a session, fall through to the 422.

Exceptions / Errors

TokenMismatchException

Laravel's TokenMismatchException: rendered as 419 with CSRF token mismatch.