Anonymous Sessions

Anonymous sessions require almost no effort in the ZF. Sometimes an application keeps track of a user's recent actions and results, such as recently viewed pages or items and recent searches or search results.

1 Anonymous Sessions

1.1 Session State Files
1.2 Starting the Session
1.3 Accessing a Session Namespace
1.4 Configuring Sessions

Session State Files

First, a new, writable directory must exist for use by Zend_Session and PHP's ext_session extension to store the session state files. One file exists for each session. Various settings in PHP's "ini" file control how often files are expired from this cached pool of session state files. Additionally, the temporary directory may eventually hold other temporary files, like cached data and compiled templates.

$temporaryDir   = realpath($appDir . $ds . 'temporary' . $ds ) . $ds;
self::$registry['temporaryDir']   = $temporaryDir;

Starting the Session

To use sessions, we initialize Zend_Session at the end of Stage 1 by first loading the configuration for Zend_Session from "config/Zend_Session.ini". Next, the location for saving session information must be adjusted to make it a unique location that does not overlap with any other web applications. Lastly, the session manager is started.

// Enable tracking of all user sessions
        $sessionConfig = new Zend_Config_Ini($configDir . 'Zend_Session.ini', self::$environment, true); 
        $sessionConfig->save_path = $temporaryDir . $sessionConfig->save_path;
        require 'Zend/Session.php'; 
        Zend_Session::setOptions($sessionConfig->asArray());  
        Zend_Session::start();

Accessing a Session Namespace

Now that the session has been configured, we need a "space" inside the session to contain some session data. The ZF supports named spaces, each with private data kept separate from other session spaces. For now, ZFDemo only needs one space, so we creatively choose the namespace 'zfdemo'.

// configure the zfdemo session namespace container
        $zfSpace = new Zend_Session_Namespace('zfdemo');
        if (!isset($zfSpace->startTime)) {
            Zend_Session::regenerateId(); // security feature
            $date = Zend_Date::now();
            self::$registry['now'] = $date;
            $zfSpace->startDate = $date->get(Zend_Date::ISO_8601); // date('Y-m-d H:i:s');
            $zfSpace->startTime = $date->getTimestamp();
            $zfSpace->requests = 1;
        } else {
            $time = Zend_Date::now()->getTimestamp();
            if (isset($zfSpace->lastVisit)) {
                $zfSpace->priorVisit = $zfSpace->lastVisit;
            } else {
                $zfSpace->priorVisit = $time;
            }
            $zfSpace->lastVisit = $time;

            // hours since last request
            self::$view->welcomeBackHours = floor(($zfSpace->lastVisit - $zfSpace->priorVisit) / 3600);
            $zfSpace->requests++; // side-effect: our session data-store modification time stays current with last visit
        }

Values of the spaces are accessed just like values in Zend_Config_Ini using the '->' access operator, such as with the session key named 'startTime'. For the first visit, a user has no data in their session space, so the application can detect this and perform initializations of the session data. The first step should be regenerating a new session id to help thwart [session hijackers]. After that, both a computer-friendly timestamp and a human-readable date are attached to the session marking the time when the session began. [Session expiration] is complex and depends on your PHP and server configuration, but can often be lengthened beyond the duration of the user's browser window.

For successive visit, after the user's first page view, the last visit time is updated, and the number of hours elapsed since their prior visit is calculated. Also, the number of requests by the user is tracked.

Configuring Sessions

Configuring sessions does require some planning to avoid accidental security flaws. In ZFDemo:

Session ids are passed between the user's web browser and the server using HTTP cookies.
Session data is saved in the 'data/sessions' directory relative to the application's source code.
Zend_Session is set to "strict" mode, which prevents auto-starting sessions on accident.
When asking Zend_Session to make the session not expire, if the user closes their window, the default time-to-live will be 10 days.

use_only_cookies = on
; Don't forget to create this directory and make it rwx (readable and modifiable) by PHP.
save_path = sessions
; strict = on|off
strict = on
; When persisting session id cookies, request a TTL of 10 days
remember_me_seconds = 864000

Next Section: 7. Identity and Authentication

Page Operations

Browse Space

6. Anonymous Sessions

Labels

Anonymous Sessions

Session State Files

Starting the Session

Accessing a Session Namespace

Configuring Sessions