Issue #2631220: Apply changes from MR 2210 to 11.x

Applies the changes from MR 2210 by James Gilliland to 11.x, with some modifications.

Differences from MR 2210:

1. SessionHandler::updateTimestamp() explicitly updates the timestamp. This is consistent with the PHP documentation and with several of Symfony's session storage handlers.
2. Uses the current logic of SessionHandler::read for the new SessionHandler::doRead.
3. Uses the current logic of SessionHandler::write for the new SessionHandler::doWrite.
4. Uses the current logic of SessionHandler::destroy for the new SessionHandler::doDestroy.
5. Adds an ini setting for session.use_strict_mode.
6. Adds #[\SensitiveParameter] to relevant methods.
7. Removes deprecation declaration on WriteSafeSessionHandler::$wrappedSessionHandler.
8. Adds a test.
9. Modifies TestSessionHandlerProxy to implement \SessionUpdateTimestampHandlerInterface. This was required to fix failing tests.

See !2210 (closed)

Closes #2631220

core/lib/Drupal/Core/Session/SessionHandler.php

@@ -8,12 +8,12 @@
 use Drupal\Core\Database\DatabaseException;
 use Drupal\Core\DependencyInjection\DependencySerializationTrait;
 use Symfony\Component\HttpFoundation\RequestStack;
-use Symfony\Component\HttpFoundation\Session\Storage\Proxy\AbstractProxy;
+use Symfony\Component\HttpFoundation\Session\Storage\Handler\AbstractSessionHandler;
 
 /**
  * Default session handler.
  */
-class SessionHandler extends AbstractProxy implements \SessionHandlerInterface {
+class SessionHandler extends AbstractSessionHandler implements \SessionHandlerInterface, \SessionUpdateTimestampHandlerInterface {
 
   use DependencySerializationTrait;
 
@@ -44,13 +44,13 @@ public function open(string $save_path, string $name): bool {
   /**
    * {@inheritdoc}
    */
-  public function read(#[\SensitiveParameter] string $sid): string|false {
+  public function doRead(#[\SensitiveParameter] string $sessionId): string {
     $data = '';
-    if (!empty($sid)) {
+    if (!empty($sessionId)) {
       try {
         // Read the session data from the database.
         $query = $this->connection
-          ->queryRange('SELECT [session] FROM {sessions} WHERE [sid] = :sid', 0, 1, [':sid' => Crypt::hashBase64($sid)]);
+          ->queryRange('SELECT [session] FROM {sessions} WHERE [sid] = :sid', 0, 1, [':sid' => Crypt::hashBase64($sessionId)]);
         $data = (string) $query->fetchField();
       }
       // Swallow the error if the table hasn't been created yet.
@@ -63,18 +63,18 @@ public function read(#[\SensitiveParameter] string $sid): string|false {
   /**
    * {@inheritdoc}
    */
-  public function write(#[\SensitiveParameter] string $sid, string $value): bool {
+  public function doWrite(#[\SensitiveParameter] string $sessionId, string $data): bool {
     $try_again = FALSE;
     $request = $this->requestStack->getCurrentRequest();
     $fields = [
       'uid' => $request->getSession()->get('uid', 0),
       'hostname' => $request->getClientIP(),
-      'session' => $value,
+      'session' => $data,
       'timestamp' => $this->time->getRequestTime(),
     ];
     $doWrite = fn() =>
       $this->connection->merge('sessions')
-        ->keys(['sid' => Crypt::hashBase64($sid)])
+        ->keys(['sid' => Crypt::hashBase64($sessionId)])
         ->fields($fields)
         ->execute();
     try {
@@ -106,11 +106,18 @@ public function close(): bool {
   /**
    * {@inheritdoc}
    */
-  public function destroy(#[\SensitiveParameter] string $sid): bool {
+  public function destroy(#[\SensitiveParameter] string $sessionId): bool {
+    return $this->doDestroy($sessionId);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function doDestroy(#[\SensitiveParameter] string $sessionId): bool {
     try {
       // Delete session data.
       $this->connection->delete('sessions')
-        ->condition('sid', Crypt::hashBase64($sid))
+        ->condition('sid', Crypt::hashBase64($sessionId))
         ->execute();
     }
     // Swallow the error if the table hasn't been created yet.
@@ -140,6 +147,16 @@ public function gc(int $lifetime): int|false {
     return FALSE;
   }
 
+  /**
+   * {@inheritdoc}
+   */
+  public function updateTimestamp(#[\SensitiveParameter] string $sessionId, string $data): bool {
+    // This function is intentionally a no-op. Drupal manages session expiry in
+    // the MetadataBag, and the timestamp should not be updated here.
+    // @see \Drupal\Core\Session\MetadataBag::__construct()
+    return TRUE;
+  }
+
   /**
    * Defines the schema for the session table.
    *