validation of session cookie
Closed this issue · 8 comments
I haven't been able to find a method for validating the session slsession cookie without extracting the token and using the JWT library directly.
I see a hasChanged() method, but it isn't obvious what this is referring to. Changing the signature of the sent cookie still returns false.
Is this missing functionality, or out of scope for the library?
The cookie is already validated?
What is observed when the token doesn't pass validation? Sorry if I'm thick, I just can't see it.
So there is no exception or error raised when the token doesn't validate? No flag to check?
Correct: the dispatch will continue, but without a valid session: any session operations will lead to a new session
Ahh, okay, so it discards the invalid token and creates a new one, which I think is the behavior of PHP session_start if it doesn't recognize the session ID.
Kinda similar, yes. Does that clear everything up? In theory, we tested every corner of this lib accurately, to prevent behaviour that isn't explicitly documented in test cases
Yes, I think so. No magic, just a session cookie passed back and forth with automatic disposal of invalid sessions. :)