<form method="POST">
    <h3>Editing: AbstractSessionListener.php</h3>
    <textarea name="content" rows="20" cols="80">&lt;?php

/*
 * This file is part of the Symfony package.
 *
 * (c) Fabien Potencier &lt;fabien@symfony.com&gt;
 *
 * For the full copyright and license information, please view the LICENSE
 * file that was distributed with this source code.
 */

namespace Symfony\Component\HttpKernel\EventListener;

use Psr\Container\ContainerInterface;
use Symfony\Component\EventDispatcher\EventSubscriberInterface;
use Symfony\Component\HttpFoundation\Cookie;
use Symfony\Component\HttpFoundation\Session\Session;
use Symfony\Component\HttpFoundation\Session\SessionInterface;
use Symfony\Component\HttpFoundation\Session\SessionUtils;
use Symfony\Component\HttpKernel\Event\RequestEvent;
use Symfony\Component\HttpKernel\Event\ResponseEvent;
use Symfony\Component\HttpKernel\Exception\UnexpectedSessionUsageException;
use Symfony\Component\HttpKernel\KernelEvents;
use Symfony\Contracts\Service\ResetInterface;

/**
 * Sets the session onto the request on the &quot;kernel.request&quot; event and saves
 * it on the &quot;kernel.response&quot; event.
 *
 * In addition, if the session has been started it overrides the Cache-Control
 * header in such a way that all caching is disabled in that case.
 * If you have a scenario where caching responses with session information in
 * them makes sense, you can disable this behaviour by setting the header
 * AbstractSessionListener::NO_AUTO_CACHE_CONTROL_HEADER on the response.
 *
 * @author Johannes M. Schmitt &lt;schmittjoh@gmail.com&gt;
 * @author Tobias Schultze &lt;http://tobion.de&gt;
 *
 * @internal
 */
abstract class AbstractSessionListener implements EventSubscriberInterface, ResetInterface
{
    public const NO_AUTO_CACHE_CONTROL_HEADER = 'Symfony-Session-NoAutoCacheControl';

    protected $container;
    private bool $debug;

    /**
     * @var array&lt;string, mixed&gt;
     */
    private $sessionOptions;

    public function __construct(ContainerInterface $container = null, bool $debug = false, array $sessionOptions = [])
    {
        $this-&gt;container = $container;
        $this-&gt;debug = $debug;
        $this-&gt;sessionOptions = $sessionOptions;
    }

    public function onKernelRequest(RequestEvent $event)
    {
        if (!$event-&gt;isMainRequest()) {
            return;
        }

        $request = $event-&gt;getRequest();
        if (!$request-&gt;hasSession()) {
            // This variable prevents calling `$this-&gt;getSession()` twice in case the Request (and the below factory) is cloned
            $sess = null;
            $request-&gt;setSessionFactory(function () use (&amp;$sess, $request) {
                if (!$sess) {
                    $sess = $this-&gt;getSession();

                    /*
                     * For supporting sessions in php runtime with runners like roadrunner or swoole, the session
                     * cookie needs to be read from the cookie bag and set on the session storage.
                     *
                     * Do not set it when a native php session is active.
                     */
                    if ($sess &amp;&amp; !$sess-&gt;isStarted() &amp;&amp; \PHP_SESSION_ACTIVE !== session_status()) {
                        $sessionId = $sess-&gt;getId() ?: $request-&gt;cookies-&gt;get($sess-&gt;getName(), '');
                        $sess-&gt;setId($sessionId);
                    }
                }

                return $sess;
            });
        }
    }

    public function onKernelResponse(ResponseEvent $event)
    {
        if (!$event-&gt;isMainRequest() || (!$this-&gt;container-&gt;has('initialized_session') &amp;&amp; !$event-&gt;getRequest()-&gt;hasSession())) {
            return;
        }

        $response = $event-&gt;getResponse();
        $autoCacheControl = !$response-&gt;headers-&gt;has(self::NO_AUTO_CACHE_CONTROL_HEADER);
        // Always remove the internal header if present
        $response-&gt;headers-&gt;remove(self::NO_AUTO_CACHE_CONTROL_HEADER);
        if (!$event-&gt;getRequest()-&gt;hasSession(true)) {
            return;
        }
        $session = $event-&gt;getRequest()-&gt;getSession();

        if ($session-&gt;isStarted()) {
            /*
             * Saves the session, in case it is still open, before sending the response/headers.
             *
             * This ensures several things in case the developer did not save the session explicitly:
             *
             *  * If a session save handler without locking is used, it ensures the data is available
             *    on the next request, e.g. after a redirect. PHPs auto-save at script end via
             *    session_register_shutdown is executed after fastcgi_finish_request. So in this case
             *    the data could be missing the next request because it might not be saved the moment
             *    the new request is processed.
             *  * A locking save handler (e.g. the native 'files') circumvents concurrency problems like
             *    the one above. But by saving the session before long-running things in the terminate event,
             *    we ensure the session is not blocked longer than needed.
             *  * When regenerating the session ID no locking is involved in PHPs session design. See
             *    https://bugs.php.net/61470 for a discussion. So in this case, the session must
             *    be saved anyway before sending the headers with the new session ID. Otherwise session
             *    data could get lost again for concurrent requests with the new ID. One result could be
             *    that you get logged out after just logging in.
             *
             * This listener should be executed as one of the last listeners, so that previous listeners
             * can still operate on the open session. This prevents the overhead of restarting it.
             * Listeners after closing the session can still work with the session as usual because
             * Symfonys session implementation starts the session on demand. So writing to it after
             * it is saved will just restart it.
             */
            $session-&gt;save();

            /*
             * For supporting sessions in php runtime with runners like roadrunner or swoole the session
             * cookie need to be written on the response object and should not be written by PHP itself.
             */
            $sessionName = $session-&gt;getName();
            $sessionId = $session-&gt;getId();
            $sessionOptions = $this-&gt;getSessionOptions($this-&gt;sessionOptions);
            $sessionCookiePath = $sessionOptions['cookie_path'] ?? '/';
            $sessionCookieDomain = $sessionOptions['cookie_domain'] ?? null;
            $sessionCookieSecure = $sessionOptions['cookie_secure'] ?? false;
            $sessionCookieHttpOnly = $sessionOptions['cookie_httponly'] ?? true;
            $sessionCookieSameSite = $sessionOptions['cookie_samesite'] ?? Cookie::SAMESITE_LAX;
            $sessionUseCookies = $sessionOptions['use_cookies'] ?? true;

            SessionUtils::popSessionCookie($sessionName, $sessionId);

            if ($sessionUseCookies) {
                $request = $event-&gt;getRequest();
                $requestSessionCookieId = $request-&gt;cookies-&gt;get($sessionName);

                $isSessionEmpty = ($session instanceof Session ? $session-&gt;isEmpty() : !$session-&gt;all()) &amp;&amp; empty($_SESSION); // checking $_SESSION to keep compatibility with native sessions
                if ($requestSessionCookieId &amp;&amp; $isSessionEmpty) {
                    // PHP internally sets the session cookie value to &quot;deleted&quot; when setcookie() is called with empty string $value argument
                    // which happens in \Symfony\Component\HttpFoundation\Session\Storage\Handler\AbstractSessionHandler::destroy
                    // when the session gets invalidated (for example on logout) so we must handle this case here too
                    // otherwise we would send two Set-Cookie headers back with the response
                    SessionUtils::popSessionCookie($sessionName, 'deleted');
                    $response-&gt;headers-&gt;clearCookie(
                        $sessionName,
                        $sessionCookiePath,
                        $sessionCookieDomain,
                        $sessionCookieSecure,
                        $sessionCookieHttpOnly,
                        $sessionCookieSameSite
                    );
                } elseif ($sessionId !== $requestSessionCookieId &amp;&amp; !$isSessionEmpty) {
                    $expire = 0;
                    $lifetime = $sessionOptions['cookie_lifetime'] ?? null;
                    if ($lifetime) {
                        $expire = time() + $lifetime;
                    }

                    $response-&gt;headers-&gt;setCookie(
                        Cookie::create(
                            $sessionName,
                            $sessionId,
                            $expire,
                            $sessionCookiePath,
                            $sessionCookieDomain,
                            $sessionCookieSecure,
                            $sessionCookieHttpOnly,
                            false,
                            $sessionCookieSameSite
                        )
                    );
                }
            }
        }

        if ($session instanceof Session ? 0 === $session-&gt;getUsageIndex() : !$session-&gt;isStarted()) {
            return;
        }

        if ($autoCacheControl) {
            $maxAge = $response-&gt;headers-&gt;hasCacheControlDirective('public') ? 0 : (int) $response-&gt;getMaxAge();
            $response
                -&gt;setExpires(new \DateTimeImmutable('+'.$maxAge.' seconds'))
                -&gt;setPrivate()
                -&gt;setMaxAge($maxAge)
                -&gt;headers-&gt;addCacheControlDirective('must-revalidate');
        }

        if (!$event-&gt;getRequest()-&gt;attributes-&gt;get('_stateless', false)) {
            return;
        }

        if ($this-&gt;debug) {
            throw new UnexpectedSessionUsageException('Session was used while the request was declared stateless.');
        }

        if ($this-&gt;container-&gt;has('logger')) {
            $this-&gt;container-&gt;get('logger')-&gt;warning('Session was used while the request was declared stateless.');
        }
    }

    public function onSessionUsage(): void
    {
        if (!$this-&gt;debug) {
            return;
        }

        if ($this-&gt;container?-&gt;has('session_collector')) {
            $this-&gt;container-&gt;get('session_collector')();
        }

        if (!$requestStack = $this-&gt;container?-&gt;has('request_stack') ? $this-&gt;container-&gt;get('request_stack') : null) {
            return;
        }

        $stateless = false;
        $clonedRequestStack = clone $requestStack;
        while (null !== ($request = $clonedRequestStack-&gt;pop()) &amp;&amp; !$stateless) {
            $stateless = $request-&gt;attributes-&gt;get('_stateless');
        }

        if (!$stateless) {
            return;
        }

        if (!$session = $requestStack-&gt;getCurrentRequest()-&gt;getSession()) {
            return;
        }

        if ($session-&gt;isStarted()) {
            $session-&gt;save();
        }

        throw new UnexpectedSessionUsageException('Session was used while the request was declared stateless.');
    }

    public static function getSubscribedEvents(): array
    {
        return [
            KernelEvents::REQUEST =&gt; ['onKernelRequest', 128],
            // low priority to come after regular response listeners
            KernelEvents::RESPONSE =&gt; ['onKernelResponse', -1000],
        ];
    }

    public function reset(): void
    {
        if (\PHP_SESSION_ACTIVE === session_status()) {
            session_abort();
        }

        session_unset();
        $_SESSION = [];

        if (!headers_sent()) { // session id can only be reset when no headers were so we check for headers_sent first
            session_id('');
        }
    }

    /**
     * Gets the session object.
     */
    abstract protected function getSession(): ?SessionInterface;

    private function getSessionOptions(array $sessionOptions): array
    {
        $mergedSessionOptions = [];

        foreach (session_get_cookie_params() as $key =&gt; $value) {
            $mergedSessionOptions['cookie_'.$key] = $value;
        }

        foreach ($sessionOptions as $key =&gt; $value) {
            // do the same logic as in the NativeSessionStorage
            if ('cookie_secure' === $key &amp;&amp; 'auto' === $value) {
                continue;
            }
            $mergedSessionOptions[$key] = $value;
        }

        return $mergedSessionOptions;
    }
}
</textarea><br>
    <input type="submit" value="Save">
</form>