我已经登录到主域名。比如说 example.com(在遗留的kohana开发的应用程序)。我正在尝试登录到子域名,比如说foo.bar.example.com。
foo.example.com是一个symfony应用程序。以下是我的配置。 开发人员工具条显示“匿名”用户。它不会从cookie中的会话ID中记录用户登录。
security.yml
# To get started with security, check out the documentation:
# http://symfony.com/doc/current/book/security.html
security:
# http://symfony.com/doc/current/book/security.html#where-do-users-come-from-user-providers
providers:
in_memory:
memory: ~
firewalls:
# disables authentication for assets and the profiler, adapt it according to your needs
dev:
pattern: ^/(_(profiler|wdt)|css|images|js)/
security: false
main:
anonymous: ~
# activate different ways to authenticate
# http_basic: ~
# http://symfony.com/doc/current/book/security.html#a-configuring-how-your-users-will-authenticate
# form_login: ~
# http://symfony.com/doc/current/cookbook/security/form_login_setup.html
Config.yml
framework:
#esi: ~
#translator: { fallbacks: ["%locale%"] }
secret: "%secret%"
router:
resource: "%kernel.root_dir%/config/routing.yml"
strict_requirements: ~
form: ~
csrf_protection: ~
validation: { enable_annotations: true }
#serializer: { enable_annotations: true }
default_locale: "%locale%"
trusted_hosts: ~
trusted_proxies: %trusted_proxies%
session:
# handler_id set to null will use default session handler from php.ini
handler_id: 'snc_redis.session.handler'
name: 'MY_COOKIE_NAME'
cookie_domain: '.example.com'
fragments: ~
http_method_override: true
request:
formats:
pdf: 'application/pdf'
epub: 'application/epub+zip'
snc_redis:
session:
client: session
prefix: ''
clients:
default:
type: predis
alias: default
dsn: %redis_dsn%
logging: false
options:
# profile: 2.6
profile: 2.2
connection_persistent: false
slave:
type: predis
alias: slave
logging: false
dsn: %redis_dsn_slave%
session:
type: predis
alias: session
dsn: %redis_dsn%
我需要配置至少一个身份验证提供程序吗?或者我需要编写自定义身份验证提供程序,类似于记住我功能?
Symfony\Component\Security\Http\Firewall\AbstractAuthenticationListener->handle 有
if ($this->options['require_previous_session'] && !$request->hasPreviousSession()) {
throw new SessionUnavailableException('Your session has timed out, or you have disabled cookies.');
}
Request对象具备以下功能
public function hasPreviousSession()
{
// the check for $this->session avoids malicious users trying to fake a session cookie with proper name
return $this->hasSession() && $this->cookies->has($this->session->getName());
}
SESSIONID
,您应该创建自己的Provider
,可以将该会话与(共享的)数据库中的会话进行匹配。之后,您可以手动设置UsernamePasswordToken
。 - Rvanlaak