Session Management

Yabasi framework provides a robust and flexible session management system. It allows you to easily handle user sessions, store and retrieve data, and implement security measures.

Configuration

Session configuration is typically stored in the config/config.php file:

return [
    'session' => [
        'driver'    => 'file',
        'lifetime'  => 120,
        'path'      => '/tmp',
        'domain'    => null,
        'secure'    => false,
        'httponly'  => true,
    ],
];

Basic Usage

Here are some basic operations you can perform with the Yabasi session management system:

Starting a Session

use Yabasi\Session\SessionManager;

$sessionManager = new SessionManager($config, $securityHandler);
$sessionManager->start();

Setting and Getting Session Data

// Set a session value
$sessionManager->set('user_id', 123);

// Get a session value
$userId = $sessionManager->get('user_id');

Checking and Removing Session Data

if ($sessionManager->has('user_id')) {
    // The 'user_id' exists in the session
    $sessionManager->remove('user_id');
}

Advanced Features

Flash Messages

Flash messages are temporary session data, typically used for one-time notifications:

// Set a flash message
$sessionManager->flash('success', 'Operation completed successfully.');

// Retrieve a flash message
$flashMessage = $sessionManager->getFlash('success');

Session Security

Yabasi provides built-in security features for sessions:

use Yabasi\Session\SecurityHandler;

$securityHandler = new SecurityHandler();
$securityHandler->setSessionIdentifiers();
SecurityHandler::preventSessionFixation();

Best Practices

• Always start the session before using any session-related functions.
• Use flash messages for temporary data that should only be available for the next request.
• Implement proper session security measures to prevent attacks like session fixation.
• Regularly regenerate session IDs to enhance security.
• Clear sensitive session data when it's no longer needed.

Yabasi's session management system provides a secure and flexible way to handle user sessions in your application. By leveraging these features, you can create robust and secure web applications.