key = \substr(\hash('sha256', $name), 0, 32); $this->name = $name; $this->ttl = $lifetime; $this->cookie = [ 'lifetime' => $this->ttl, 'path' => "/", 'domain' => "." . \preg_replace('/www\./i', '', $_SERVER['SERVER_NAME']), 'secure' => isset($_SERVER['HTTPS']), 'httponly' => true ]; $this->setup(); } //set things up protected function setup() { \ini_set('session.use_cookies', 1); \ini_set('session.use_only_cookies', 1); \ini_set('session.save_path', \realpath(self::SAVE_PATH)); \session_name($this->name); \session_set_cookie_params( $this->cookie['lifetime'], $this->cookie['path'], $this->cookie['domain'], $this->cookie['secure'], $this->cookie['httponly'] ); } //is the session already started protected function sessionStarted() { return \session_id() !== "" || \session_status() === PHP_SESSION_ACTIVE; } /** * Call this method to initially start the session * */ public function start() { if (!$this->sessionStarted()) { if (\session_start()) { $hash = md5($_SERVER['HTTP_USER_AGENT'] . "---|---" . $this->name); $_SESSION['_fingerprint'] = $hash; return mt_rand(0, 4) === 0 ? $this->refresh() : true; // 1/5, regenerate sid } } return false; } /** * Call this method to resume a previously started session * */ public function resume() { if (!isset($_COOKIE) || !\array_key_exists($this->name, $_COOKIE)) { //coookie prob expired $this->forget(); return false; } if (!$this->sessionStarted()) { if (\session_start()) { $this->refresh(); } } if (!$this->isFingerprint()) { //UA doesnt match $this->forget(); return false; } return true; } /** * End the session * */ public function end() { return $this->forget(); } /** * Return the current SID * */ public function getSID() { return \session_id(); } protected function forget() { if (!$this->sessionStarted()) { if (\session_start()) { } } \setcookie( $this->name, '', time() - 42000, $this->cookie['path'], $this->cookie['domain'], $this->cookie['secure'], $this->cookie['httponly'] ); unset($_SESSION); \session_destroy(); return true; } protected function refresh() { return session_regenerate_id(true); } public function open($save_path, $session_name) { return parent::open($save_path, $session_name); } public function read($id) { return (string) @openssl_decrypt(parent::read($id), "aes-256-cbc", $this->key); } public function write($id, $data) { return parent::write($id, @openssl_encrypt($data, "aes-256-cbc", $this->key)); } protected function isFingerprint() { $hash = \md5($_SERVER['HTTP_USER_AGENT'] . "---|---" . $this->name); if (isset($_SESSION['_fingerprint'])) { return $_SESSION['_fingerprint'] === $hash; } return false; } /** * Get a previously set value associated with this session * @param string|integer $key The key to be used in retrieving a value * * @return mixed|boolean Returns the value set with $key or an empty string if the key is not found * *@throws DomainException If there are no active sessions */ public function get($key) { if (!$this->sessionStarted()) { throw new \DomainException("Cant retrieve value from NULL session"); } if (\array_key_exists($key, $_SESSION)) { return $_SESSION[$key]; } return ''; } /** * Associates a key/value with this session * @param string|integer $key * @param mixed $value * @return boolean * @throws DomainException If there are no active sessions */ public function put($key, $value) { if (!$this->sessionStarted()) { throw new \DomainException("Cant set value on NULL session"); } $_SESSION[$key] = $value; return true; } }