From e7e174b05d63e6e62fdd8f70a8824c9a2ff4363c Mon Sep 17 00:00:00 2001 From: Marco Date: Mon, 12 Mar 2018 22:29:56 +0100 Subject: [PATCH] Only configure and start session if not already started --- src/Auth.php | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/src/Auth.php b/src/Auth.php index c7ad7ed..25dcce9 100644 --- a/src/Auth.php +++ b/src/Auth.php @@ -48,7 +48,7 @@ final class Auth extends UserManager { $this->sessionResyncInterval = isset($sessionResyncInterval) ? ((int) $sessionResyncInterval) : (60 * 5); $this->rememberCookieName = self::createRememberCookieName(); - $this->initSession(); + $this->initSessionIfNecessary(); $this->enhanceHttpSecurity(); $this->processRememberDirective(); @@ -56,16 +56,18 @@ final class Auth extends UserManager { } /** Initializes the session and sets the correct configuration */ - private function initSession() { - // use cookies to store session IDs - \ini_set('session.use_cookies', 1); - // use cookies only (do not send session IDs in URLs) - \ini_set('session.use_only_cookies', 1); - // do not send session IDs in URLs - \ini_set('session.use_trans_sid', 0); + private function initSessionIfNecessary() { + if (\session_status() === \PHP_SESSION_NONE) { + // use cookies to store session IDs + \ini_set('session.use_cookies', 1); + // use cookies only (do not send session IDs in URLs) + \ini_set('session.use_only_cookies', 1); + // do not send session IDs in URLs + \ini_set('session.use_trans_sid', 0); - // start the session (requests a cookie to be written on the client) - @Session::start(); + // start the session (requests a cookie to be written on the client) + @Session::start(); + } } /** Improves the application's security over HTTP(S) by setting specific headers */