Question

I’m using a flash component in my symfony2 application which uploads multiple images, and when they reach the server I want to re-open the session so that I can store the image in a location relative to the logged in user. I am sending the PHP session ID with each file upload…

In vanilla PHP I can achieve this along the lines of…

session_id($originalSessionId);
session_start();

but is there a symfony2 way of doing this using the security context?

EDIT: This is a similar question, although I want to maybe create some kind of token based login by passing a token and securing the upload URL with a separate firewall.

Answer 1

First, you need to create your own session storage class like the following:

<?php
namespace Elao\BackBundle\Session;
use Symfony\Component\DependencyInjection\ContainerInterface;
use Symfony\Component\HttpFoundation\SessionStorage\NativeSessionStorage;

class Storage extends NativeSessionStorage
{
    public function __construct(array $options = array(), ContainerInterface $container)
    {
        $request = $container->get('request');
        if ($request->query->has('sessionId')) {
            $request->cookies->set(session_name(), 1);    // We have to simulate this cookie, in order to bypass the "hasPreviousSession" security check
            session_id($request->query->get('sessionId'));
        }
        return parent::__construct($options);
    }
}

Then, you must redefine the default one (in your config.yml for example):

parameters:
    session.storage.native.class: ElaoBackBundleSessionStorage
services:
    session.storage.native:
        class:     %session.storage.native.class%
        arguments: [%session.storage.options%, @service_container]