Inheritance diagram for Validator:

Public Member Functions
	__construct (\Magento\Framework\App\Config\ScopeConfigInterface $scopeConfig, \Magento\Framework\HTTP\PhpEnvironment\RemoteAddress $remoteAddress, $scopeType, array $skippedUserAgentList=[])

	validate (SessionManagerInterface $session)

Public Member Functions inherited from ValidatorInterface
	validate (\Magento\Framework\Session\SessionManagerInterface $session)

Data Fields
const	VALIDATOR_KEY = '_session_validator_data'

const	VALIDATOR_HTTP_USER_AGENT_KEY = 'http_user_agent'

const	VALIDATOR_HTTP_X_FORWARDED_FOR_KEY = 'http_x_forwarded_for'

const	VALIDATOR_HTTP_VIA_KEY = 'http_via'

const	VALIDATOR_REMOTE_ADDR_KEY = 'remote_addr'

const	XML_PATH_USE_REMOTE_ADDR = 'web/session/use_remote_addr'

const	XML_PATH_USE_HTTP_VIA = 'web/session/use_http_via'

const	XML_PATH_USE_X_FORWARDED = 'web/session/use_http_x_forwarded_for'

const	XML_PATH_USE_USER_AGENT = 'web/session/use_http_user_agent'

Protected Member Functions
	_validate ()

	_getSessionEnvironment ()

Protected Attributes
	$_scopeConfig

	$_remoteAddress

	$_skippedAgentList

	$_scopeType

Detailed Description

Session Validator

Definition at line 15 of file Validator.php.

Constructor & Destructor Documentation

◆ __construct()

__construct	(	\Magento\Framework\App\Config\ScopeConfigInterface	$scopeConfig,
		\Magento\Framework\HTTP\PhpEnvironment\RemoteAddress	$remoteAddress,
			$scopeType,
		array	$skippedUserAgentList = `[]`
	)

Parameters

\Magento\Framework\App\Config\ScopeConfigInterface	$scopeConfig
\Magento\Framework\HTTP\PhpEnvironment\RemoteAddress	$remoteAddress
string	$scopeType
array	$skippedUserAgentList

Definition at line 61 of file Validator.php.

       {
         $this->_scopeConfig = $scopeConfig;
         $this->_remoteAddress = $remoteAddress;
         $this->_skippedAgentList = $skippedUserAgentList;
         $this->_scopeType = $scopeType;
     }

Member Function Documentation

◆ _getSessionEnvironment()

_getSessionEnvironment ( )

protected

Prepare session environment data for validation

Returns: array

Definition at line 172 of file Validator.php.

     {
         $parts = [
             self::VALIDATOR_REMOTE_ADDR_KEY => '',
             self::VALIDATOR_HTTP_VIA_KEY => '',
             self::VALIDATOR_HTTP_X_FORWARDED_FOR_KEY => '',
             self::VALIDATOR_HTTP_USER_AGENT_KEY => '',
         ];
 
         // collect ip data
         if ($this->_remoteAddress->getRemoteAddress()) {
             $parts[self::VALIDATOR_REMOTE_ADDR_KEY] = $this->_remoteAddress->getRemoteAddress();
         }
         if (isset($_ENV['HTTP_VIA'])) {
             $parts[self::VALIDATOR_HTTP_VIA_KEY] = (string)$_ENV['HTTP_VIA'];
         }
         if (isset($_ENV['HTTP_X_FORWARDED_FOR'])) {
             $parts[self::VALIDATOR_HTTP_X_FORWARDED_FOR_KEY] = (string)$_ENV['HTTP_X_FORWARDED_FOR'];
         }
 
         // collect user agent data
         if (isset($_SERVER['HTTP_USER_AGENT'])) {
             $parts[self::VALIDATOR_HTTP_USER_AGENT_KEY] = (string)$_SERVER['HTTP_USER_AGENT'];
         }
 
         return $parts;
     }

◆ _validate()

_validate ( )

protected

Validate data

Returns: bool

Exceptions

SessionException @SuppressWarnings(PHPMD.CyclomaticComplexity)

Definition at line 102 of file Validator.php.

     {
         $sessionData = $_SESSION[self::VALIDATOR_KEY];
         $validatorData = $this->_getSessionEnvironment();
 
         if ($this->_scopeConfig->getValue(
             self::XML_PATH_USE_REMOTE_ADDR,
             $this->_scopeType
         ) && $sessionData[self::VALIDATOR_REMOTE_ADDR_KEY] != $validatorData[self::VALIDATOR_REMOTE_ADDR_KEY]
         ) {
             throw new SessionException(
                 new Phrase(
                     'The "%1" session value is invalid. Verify and try again.',
                     [self::VALIDATOR_REMOTE_ADDR_KEY]
                 )
             );
         }
         if ($this->_scopeConfig->getValue(
             self::XML_PATH_USE_HTTP_VIA,
             $this->_scopeType
         ) && $sessionData[self::VALIDATOR_HTTP_VIA_KEY] != $validatorData[self::VALIDATOR_HTTP_VIA_KEY]
         ) {
             throw new SessionException(
                 new Phrase(
                     'The "%1" session value is invalid. Verify and try again.',
                     [self::VALIDATOR_HTTP_VIA_KEY]
                 )
             );
         }
 
         $httpXForwardedKey = $sessionData[self::VALIDATOR_HTTP_X_FORWARDED_FOR_KEY];
         $validatorXForwarded = $validatorData[self::VALIDATOR_HTTP_X_FORWARDED_FOR_KEY];
         if ($this->_scopeConfig->getValue(
             self::XML_PATH_USE_X_FORWARDED,
             $this->_scopeType
         ) && $httpXForwardedKey != $validatorXForwarded
         ) {
             throw new SessionException(
                 new Phrase(
                     'The "%1" session value is invalid. Verify and try again.',
                     [self::VALIDATOR_HTTP_X_FORWARDED_FOR_KEY]
                 )
             );
         }
         if ($this->_scopeConfig->getValue(
             self::XML_PATH_USE_USER_AGENT,
             $this->_scopeType
         ) && $sessionData[self::VALIDATOR_HTTP_USER_AGENT_KEY] != $validatorData[self::VALIDATOR_HTTP_USER_AGENT_KEY]
         ) {
             foreach ($this->_skippedAgentList as $agent) {
                 if (preg_match('/' . $agent . '/iu', $validatorData[self::VALIDATOR_HTTP_USER_AGENT_KEY])) {
                     return true;
                 }
             }
             throw new SessionException(
                 new Phrase(
                     'The "%1" session value is invalid. Verify and try again.',
                     [self::VALIDATOR_HTTP_USER_AGENT_KEY]
                 )
             );
         }
 
         return true;
     }

◆ validate()

validate ( SessionManagerInterface $session )

Validate session

Parameters

SessionManagerInterface $session

Returns: void

Exceptions

SessionException

Definition at line 80 of file Validator.php.

     {
         if (!isset($_SESSION[self::VALIDATOR_KEY])) {
             $_SESSION[self::VALIDATOR_KEY] = $this->_getSessionEnvironment();
         } else {
             try {
                 $this->_validate();
             } catch (SessionException $e) {
                 $session->destroy(['clear_storage' => false]);
                 // throw core session exception
                 throw $e;
             }
         }
     }

Field Documentation

◆ $_remoteAddress

$_remoteAddress

protected

Definition at line 43 of file Validator.php.

◆ $_scopeConfig

$_scopeConfig

protected

Definition at line 38 of file Validator.php.

◆ $_scopeType

$_scopeType

protected

Definition at line 53 of file Validator.php.

◆ $_skippedAgentList

$_skippedAgentList

protected

Definition at line 48 of file Validator.php.

◆ VALIDATOR_HTTP_USER_AGENT_KEY

const VALIDATOR_HTTP_USER_AGENT_KEY = 'http_user_agent'

Definition at line 19 of file Validator.php.

◆ VALIDATOR_HTTP_VIA_KEY

const VALIDATOR_HTTP_VIA_KEY = 'http_via'

Definition at line 23 of file Validator.php.

◆ VALIDATOR_HTTP_X_FORWARDED_FOR_KEY

const VALIDATOR_HTTP_X_FORWARDED_FOR_KEY = 'http_x_forwarded_for'

Definition at line 21 of file Validator.php.

◆ VALIDATOR_KEY

const VALIDATOR_KEY = '_session_validator_data'

Definition at line 17 of file Validator.php.

◆ VALIDATOR_REMOTE_ADDR_KEY

const VALIDATOR_REMOTE_ADDR_KEY = 'remote_addr'

Definition at line 25 of file Validator.php.

◆ XML_PATH_USE_HTTP_VIA

const XML_PATH_USE_HTTP_VIA = 'web/session/use_http_via'

Definition at line 29 of file Validator.php.

◆ XML_PATH_USE_REMOTE_ADDR

const XML_PATH_USE_REMOTE_ADDR = 'web/session/use_remote_addr'

Definition at line 27 of file Validator.php.

◆ XML_PATH_USE_USER_AGENT

const XML_PATH_USE_USER_AGENT = 'web/session/use_http_user_agent'

Definition at line 33 of file Validator.php.

◆ XML_PATH_USE_X_FORWARDED

const XML_PATH_USE_X_FORWARDED = 'web/session/use_http_x_forwarded_for'

Definition at line 31 of file Validator.php.

The documentation for this class was generated from the following file:

vendor/magento/framework/Session/Validator.php

Public Member Functions

Data Fields

Protected Member Functions

Protected Attributes

Detailed Description

Constructor & Destructor Documentation

◆ __construct()

Member Function Documentation

◆ _getSessionEnvironment()

◆ _validate()

◆ validate()

Field Documentation

◆ $_remoteAddress

◆ $_scopeConfig

◆ $_scopeType

◆ $_skippedAgentList

◆ VALIDATOR_HTTP_USER_AGENT_KEY

◆ VALIDATOR_HTTP_VIA_KEY

◆ VALIDATOR_HTTP_X_FORWARDED_FOR_KEY

◆ VALIDATOR_KEY

◆ VALIDATOR_REMOTE_ADDR_KEY

◆ XML_PATH_USE_HTTP_VIA

◆ XML_PATH_USE_REMOTE_ADDR

◆ XML_PATH_USE_USER_AGENT

◆ XML_PATH_USE_X_FORWARDED