Sessions

A session is the data of one visitor that the server keeps between requests: who is logged in, what is in the cart. The browser receives only a cookie with the session number. In Laminas sessions are handled by the laminas-session package.

Installation

composer require laminas/laminas-session

Agree to inject the Laminas\Session module into config/modules.config.php.

The session container

Session data is read and written through a Container object. It needs no file of its own — the object is created right in the action:

// module/Blog/src/Controller/PostController.php
use Laminas\Session\Container;
 
public function indexAction()
{
    $session = new Container('blog');
    $session->visits = ($session->visits ?? 0) + 1;
 
    return new ViewModel([
        'posts' => $this->posts->fetchAll(),
        'visits' => $session->visits,
    ]);
}

The 'blog' argument is the name of a session section: data of different parts of the site does not get mixed. Refresh the /blog page a few times — the $this->visits value in the view script grows: 1, 2, 3.

Working with values

Code	What it does
`$session->name = 'Anna'`	Saves a value
`$session->name`	Reads a value
`isset($session->name)`	Checks whether the value exists
`unset($session->name)`	Removes the value
`$session->getManager()->destroy()`	Destroys the whole session

Session settings

Cookie parameters and the lifetime are set in the session_config section of config/autoload/global.php:

// config/autoload/global.php
return [
    'session_config' => [
        'name' => 'blog_session',
        'cookie_lifetime' => 3600,
        'gc_maxlifetime' => 3600,
        'cookie_httponly' => true,
    ],
];

Key	Meaning
`name`	The cookie name
`cookie_lifetime`	How many seconds the cookie lives in the browser
`gc_maxlifetime`	After how many seconds the server removes an unused session
`cookie_httponly`	Forbid JavaScript to read the cookie

For the settings to take effect, the session manager must be fetched from the service container once on startup. This is done in the onBootstrap() method of the module class — Laminas calls it at the start of every request:

// module/Blog/src/Module.php
use Laminas\Mvc\MvcEvent;
use Laminas\Session\SessionManager;
 
public function onBootstrap(MvcEvent $event): void
{
    $event->getApplication()->getServiceManager()->get(SessionManager::class);
}

From then on every Container object uses the manager with your settings.

Protecting a form: Csrf

CSRF is an attack in which another site submits a form on behalf of a logged-in visitor. The protection is a secret token: it is kept in the session and inserted into the form as a hidden field. Add the element in the PostForm constructor:

// module/Blog/src/Form/PostForm.php
$this->add([
    'name' => 'csrf',
    'type' => Element\Csrf::class,
]);

In the add.phtml view script print it before the button:

<!-- module/Blog/view/blog/post/add.phtml -->
<?= $this->formHidden($form->get('csrf')) ?>

The element checks the token itself in isValid(): a form submitted without it or with someone else's token fails validation.

Common mistake

Do not put large objects or whole table rows into the session: they are saved on every request and go stale when the data in the database changes. Keep only identifiers and small values in the session, and load the data itself from the database each time.

Thanks for reading!