symfony/symfony — pull request #12810 by ajgarlag (2014-12-02 16:22:23+00:00)
Title: [Security] Session concurrency control

| Q | A
| ------------- | ---
| Bug fix? | yes
| New feature? | yes
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | #7845
| License | MIT
| Doc PR |

This PR allow you to control concurrent sessions. You can choose if you want to block new sessions or expire the oldest ones in order to limit the number of active sessions per user. To limit the access from expired sessions, **this PR depends on the new firewall introduced in #12807**.

To expire the oldest sessions, is necessary to access to the other sessions information from the current request, so a `SessionRegistry` is used to store this info. This service relies on a session storage service (`SessionRegistryStorageInterface`) to persist the info. Currently only a filesystem based implementation is provided; a Doctrine based one could be added to the Doctrine Bridge as I did in my previous #12009 PR.

As it occurs with the sessions, the information stored in the registry, should be periodically removed. Currently, I've implemented an event listener that will be called with the same probability that the native session garbage collector, but any better solution to sync garbage collection for native sessions and registry info is welcome.