WEBAPI: PHP session is always started 2.1.2

[boldhedgehog]

Although REST API should be stateless for anonymous calls, PHP session is always created. This is caused by the fact that session_start() is called implicitly from '\Magento\Framework\Session\SessionManager' constructor.

There are 2 issues with this: Spammed PHP session which will never be used, if remote address validation is enabled for sessions, clients with dynamic IP address will get 302 redirect instead of REST API result, and this is undesirable.

Preconditions

1. Magento 2.4-develop

Steps to reproduce

1. Make a REST request, for example from Swagger UI, but it can be a request from any client. For example, call /V1/directory/countries

Expected result

1. Received JSON response with countries;
2. No PHP session is started;
3. No PHPSESSID in the response cookies.

Actual result

1. PHP session is started and is perhaps never used (because the request is anonymous)

Why?

The reason for this is that in di.xml \Magento\Authorization\Model\CompositeUserContext is fed with userContexts argument, and at least 2 of them will start PHP session: customerSessionUserContext and adminSessionUserContext.

How to fix

My PoC solution was to modify vendor/magento/module-customer/etc/webapi_rest/di.xml and vendor/magento/module-user/etc/webapi_rest/di.xml so that types for userContext would be Proxies, and they would be created on-demand.

<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:ObjectManager/etc/config.xsd">
     <type name="Magento\Framework\Authorization">
        <plugin name="customerAuthorization" type="Magento\Customer\Model\Plugin\CustomerAuthorization" />
    </type>
    <type name="Magento\Authorization\Model\CompositeUserContext">
        <arguments>
            <argument name="userContexts" xsi:type="array">
                <item name="customerSessionUserContext" xsi:type="array">
 <!-- *********************** LET IT BE A PROXY ************************** -->
                    <item name="type" xsi:type="object">Magento\Customer\Model\Authorization\CustomerSessionUserContext\Proxy</item>
                    <item name="sortOrder" xsi:type="string">20</item>
                </item>
                <item name="adminSessionUserContext" xsi:type="array">
 <!-- *********************** LET IT BE A PROXY ************************** -->
                    <item name="type" xsi:type="object">Magento\User\Model\Authorization\AdminSessionUserContext\Proxy</item>
                    <item name="sortOrder" xsi:type="string">30</item>
                </item>
            </argument>
        </arguments>
    </type>
</config>

<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:ObjectManager/etc/config.xsd">
    <type name="Magento\Authorization\Model\CompositeUserContext">
        <arguments>
            <argument name="userContexts" xsi:type="array">
                <item name="adminSessionUserContext" xsi:type="array">
 <!-- *********************** LET IT BE A PROXY ************************** -->
                    <item name="type" xsi:type="object">Magento\User\Model\Authorization\AdminSessionUserContext\Proxy</item>
                    <item name="sortOrder" xsi:type="string">30</item>
                </item>
            </argument>
        </arguments>
    </type>
</config>

I do not know which one of the changes fixed the issue, but I achieved the expected result.

[magento-engcom-team]

@boldhedgehog, thank you for your report.
We've created internal ticket(s) MAGETWO-81390 to track progress on the issue.

[magento-team]

Hi @boldhedgehog. Thank you for your report.
The issue has been fixed in magento-engcom/magento2ce#1247 by @serhii-balko in 2.2-develop branch
Related commit(s):

• a282973
• 6a58610

The fix will be available with the upcoming patch release.

[maqlec]

Dear @magento-team, you have merged something wrong because this fix is in 2.2 but in 2.3 and later is not.

[ihor-sviziev]

I re-opened this task. Issue was fixed in 2.2.x, but not in 2.3.x and 2.4.x release lines. #26032 fixes this issue

[m2-assistant]

Hi @engcom-Delta. Thank you for working on this issue.
In order to make sure that issue has enough information and ready for development, please read and check the following instruction: 👇

• 1. Verify that issue has all the required information. (Preconditions, Steps to reproduce, Expected result, Actual result).

  Details

  If the issue has a valid description, the label Issue: Format is valid will be added to the issue automatically. Please, edit issue description if needed, until label Issue: Format is valid appears.

• 2. Verify that issue has a meaningful description and provides enough information to reproduce the issue. If the report is valid, add Issue: Clear Description label to the issue by yourself.

• 3. Add Component: XXXXX label(s) to the ticket, indicating the components it may be related to.

• 4. Verify that the issue is reproducible on 2.4-develop branch

  Details

  - Add the comment @magento give me 2.4-develop instance to deploy test instance on Magento infrastructure.
  - If the issue is reproducible on 2.4-develop branch, please, add the label Reproduced on 2.4.x.
  - If the issue is not reproducible, add your comment that issue is not reproducible and close the issue and stop verification process here!

• 5. Add label Issue: Confirmed once verification is complete.

• 6. Make sure that automatic system confirms that report has been added to the backlog.

[magento-engcom-team]

✅ Confirmed by @engcom-Delta
Thank you for verifying the issue. Based on the provided information internal tickets MC-35585 were created

Issue Available: @engcom-Delta, You will be automatically unassigned. Contributors/Maintainers can claim this issue to continue. To reclaim and continue work, reassign the ticket to yourself.

[slavvka]

Hi @boldhedgehog. Thank you for your report.
The issue has been fixed in #26032 by @maqlec in 2.4-develop branch
Related commit(s):

• 859307b2cf3cd1898cf9d38860408a9eebdade2d
• 8aed39fd69115f93282e933fdbdf7d8584daa082
• 4a05e7864ae1621dff12469cc8395ebace13699e
• cfa889ef339d9ab826eff143d25a6a4b8ec39b20
• b219c4e8a260bd6742a0d19954aa157791ac6727
• c5ad40b08a573abe2a860ad9878c89d56addb3a0
• fe0bd17618396d4f34cdd93feed97e235af731af
• ac0dea54914ecab82eb17a1584d4ee38c686ce9c
• ea10595bb44c8b51b204e8e5fbd6a8c503a2b6c1
• b4a02ddd4f25d813f581f248a635e94b6e0ef049
• 4f20656f3cebfc38bcd37147daa730e8b207f94c
• 192bc7ef8da513d5eb6fbb2d85f965f58b6a2929
• f14976352e81c6575fbea9f5c906132d62d9036a
• ac0f4e6c48642fbf4906c88e6210c1fa0d979469
• 3e833b3b9d4f472a8e1ddb7aac47949ed7054a13
• c1f5509be14c507b71ca7fd9a036ff5b86dbe71c
• edd0ccd386e438f20a548d67d707b0866e2767dc
• 4dac67dbf06550a1e36f2e463dad8b8f3e36a457
• 97b235dc454515ed2eb85e1f030e2fb1dc530ed0
• 16797c30c9108fa47c00fad92acc83e01734d8d6

The fix will be available with the upcoming 2.4.1 release.