Problem/Motivation

See #1289536-304: Switch Watchdog to a PSR-3 logging framework

Our session handling is tightly coupled with user module, which leads to strange bugs during installation, when user module is not installed yet.

Proposed resolution

Decouple session from users

Remaining tasks

Agree on the approach

User interface changes

None

API changes

TBD

Comments

znerol’s picture

znerol commented

There are authentication methods not relying on a session (i.e. HTTP basic auth). Decoupling sessions from users is definitely the way to go.

ParisLiakos’s picture

ParisLiakos commented
Issue summary: View changes
Related issues: +#1858196: [meta] Leverage Symfony Session components

i would like to keep this postponed till #1858196: [meta] Leverage Symfony Session components
It would be easier to fix by then

znerol’s picture

znerol commented

In my opinion we can hardly reach #1858196: [meta] Leverage Symfony Session components without uncoupling sessions from users, therefore this is more like a sub-issue of the meta.

berdir’s picture

berdir
Primary language German
Location Switzerland
commented

With #2345611: [pp-1] Load user entity in Cookie AuthenticationProvider instead of using manual queries, the direction could be that the concept of global user could go away from session completely, the session manager or something could trigger an event, user could listen on that and populate global user based on that data.

The concept of current user would still exist in core, but maybe it could be set to AnonymousUserSession() by default.

znerol’s picture

znerol commented
Status: Postponed » Closed (duplicate)
Related issues: +#2228393: Decouple session from cookie based user authentication