function SessionTest::testAnonymousSessionFixation

Tests that an invalid session ID in the cookie is rejected.

@covers \Drupal\Core\Session\SessionManager::start

File

core/modules/system/tests/src/Functional/Session/SessionTest.php, line 187

Class

SessionTest

Drupal session handling tests.

Namespace

Code

public function testAnonymousSessionFixation() : void {
  $mink = $this->getSession();
  $connection = Database::getConnection();
  // Initialize a session for anonymous user.
  $this->drupalGet('session-test/set/foo');
  // Switch browser cookie to arbitrary session_id.
  $session_cookie_name = $this->getSessionName();
  $initial_session_cookie_value = $mink->getCookie($session_cookie_name);
  $mink->restart();
  $this->initFrontPage();
  // Session restart always resets all the cookies by design, so we
  // set an arbitrary session_id in the cookie for the next request.
  $invalid_session_cookie_value = bin2hex($this->randomMachineName(13));
  $mink->setCookie($session_cookie_name, $invalid_session_cookie_value);
  // Make another request.
  sleep(1);
  $this->drupalGet('session-test/set/bar');
  // Check returned cookie value.
  $returned_session_cookie_value = $mink->getCookie($session_cookie_name);
  // The backend should reject $invalid_session_cookie_value and return a
  // new session_id that's different from both the first and the invalid
  // SIDs.
  $this->assertNotEquals($initial_session_cookie_value, $returned_session_cookie_value, 'Returned session ID is not equal to initial session ID');
  $this->assertNotEquals($invalid_session_cookie_value, $returned_session_cookie_value, 'Returned session ID is not equal to invalid session ID');
  // Check that invalid SID does not exist in database.
  $this->assertEmpty($connection->select('sessions', 's')
    ->fields('s', [
    'timestamp',
  ])
    ->condition('sid', Crypt::hashBase64($invalid_session_cookie_value))
    ->execute()
    ->fetchField(), 'Invalid session ID is not in database');
  // Check that returned SID does exist in database.
  $this->assertNotEmpty($connection->select('sessions', 's')
    ->fields('s', [
    'timestamp',
  ])
    ->condition('sid', Crypt::hashBase64($returned_session_cookie_value))
    ->execute()
    ->fetchField(), 'Returned session ID is in database');
}