5.4/migration/wsc53/session/index.html

   1
   2 <!doctype html>
   3 <html lang="en" class="no-js">
   4   <head>
   5
   6       <meta charset="utf-8">
   7       <meta name="viewport" content="width=device-width,initial-scale=1">
   8
   9
  10
  11
  12       <link rel="shortcut icon" href="../../../assets/default.favicon.ico">
  13       <meta name="generator" content="mkdocs-1.1.2, mkdocs-material-7.0.5">
  14
  15
  16
  17         <title>Session Handling and Authentication - WoltLab Suite Documentation</title>
  18
  19
  20
  21       <link rel="stylesheet" href="../../../assets/stylesheets/main.77f3fd56.min.css">
  22
  23
  24         <link rel="stylesheet" href="../../../assets/stylesheets/palette.7fa14f5b.min.css">
  25
  26
  27
  28           <meta name="theme-color" content="#009485">
  29
  30
  31
  32
  33
  34
  35
  36
  37
  38       <link rel="stylesheet" href="../../../stylesheets/extra.css">
  39
  40
  41
  42
  43
  44   </head>
  45
  46
  47
  48
  49
  50
  51
  52     <body dir="ltr" data-md-color-scheme="" data-md-color-primary="teal" data-md-color-accent="">
  53
  54
  55
  56     <input class="md-toggle" data-md-toggle="drawer" type="checkbox" id="__drawer" autocomplete="off">
  57     <input class="md-toggle" data-md-toggle="search" type="checkbox" id="__search" autocomplete="off">
  58     <label class="md-overlay" for="__drawer"></label>
  59     <div data-md-component="skip">
  60
  61
  62         <a href="#migrating-from-wsc-53-session-handling-and-authentication" class="md-skip">
  63           Skip to content
  64         </a>
  65
  66     </div>
  67     <div data-md-component="announce">
  68
  69         <aside class="md-announce">
  70           <div class="md-announce__inner md-grid md-typeset">
  71
  72     <a href="https://www.woltlab.com">Back to <strong>woltlab.com</strong></a>
  73
  74           </div>
  75         </aside>
  76
  77     </div>
  78
  79
  80
  81 <header class="md-header" data-md-component="header">
  82   <nav class="md-header__inner md-grid" aria-label="Header">
  83     <a href="../../.." title="WoltLab Suite Documentation" class="md-header__button md-logo" aria-label="WoltLab Suite Documentation">
  84
  85   <img src="../../../assets/logo.png" alt="logo">
  86
  87     </a>
  88     <label class="md-header__button md-icon" for="__drawer">
  89       <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M3 6h18v2H3V6m0 5h18v2H3v-2m0 5h18v2H3v-2z"/></svg>
  90     </label>
  91     <div class="md-header__title" data-md-component="header-title">
  92       <div class="md-header__ellipsis">
  93         <div class="md-header__topic">
  94           <span class="md-ellipsis">
  95             WoltLab Suite Documentation
  96           </span>
  97         </div>
  98         <div class="md-header__topic" data-md-component="header-topic">
  99           <span class="md-ellipsis">
 100
 101               Session Handling and Authentication
 102
 103           </span>
 104         </div>
 105       </div>
 106     </div>
 107     <div class="md-header__options">
 108
 109     </div>
 110
 111       <label class="md-header__button md-icon" for="__search">
 112         <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.516 6.516 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5z"/></svg>
 113       </label>
 114
 115 <div class="md-search" data-md-component="search" role="dialog">
 116   <label class="md-search__overlay" for="__search"></label>
 117   <div class="md-search__inner" role="search">
 118     <form class="md-search__form" name="search">
 119       <input type="text" class="md-search__input" name="query" aria-label="Search" placeholder="Search" autocapitalize="off" autocorrect="off" autocomplete="off" spellcheck="false" data-md-component="search-query" data-md-state="active" required>
 120       <label class="md-search__icon md-icon" for="__search">
 121         <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.516 6.516 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5z"/></svg>
 122         <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11h12z"/></svg>
 123       </label>
 124       <button type="reset" class="md-search__icon md-icon" aria-label="Clear" tabindex="-1">
 125         <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M19 6.41L17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12 19 6.41z"/></svg>
 126       </button>
 127     </form>
 128     <div class="md-search__output">
 129       <div class="md-search__scrollwrap" data-md-scrollfix>
 130         <div class="md-search-result" data-md-component="search-result">
 131           <div class="md-search-result__meta">
 132             Initializing search
 133           </div>
 134           <ol class="md-search-result__list"></ol>
 135         </div>
 136       </div>
 137     </div>
 138   </div>
 139 </div>
 140
 141
 142       <div class="md-header__source">
 143
 144 <a href="https://github.com/WoltLab/docs.woltlab.com/" title="Go to repository" class="md-source" data-md-component="source">
 145   <div class="md-source__icon md-icon">
 146
 147     <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><path d="M439.55 236.05L244 40.45a28.87 28.87 0 0 0-40.81 0l-40.66 40.63 51.52 51.52c27.06-9.14 52.68 16.77 43.39 43.68l49.66 49.66c34.23-11.8 61.18 31 35.47 56.69-26.49 26.49-70.21-2.87-56-37.34L240.22 199v121.85c25.3 12.54 22.26 41.85 9.08 55a34.34 34.34 0 0 1-48.55 0c-17.57-17.6-11.07-46.91 11.25-56v-123c-20.8-8.51-24.6-30.74-18.64-45L142.57 101 8.45 235.14a28.86 28.86 0 0 0 0 40.81l195.61 195.6a28.86 28.86 0 0 0 40.8 0l194.69-194.69a28.86 28.86 0 0 0 0-40.81z"/></svg>
 148   </div>
 149   <div class="md-source__repository">
 150     GitHub
 151   </div>
 152 </a>
 153       </div>
 154
 155   </nav>
 156 </header>
 157
 158     <div class="md-container" data-md-component="container">
 159
 160
 161
 162
 163       <main class="md-main" data-md-component="main">
 164         <div class="md-main__inner md-grid">
 165
 166
 167
 168               <div class="md-sidebar md-sidebar--primary" data-md-component="sidebar" data-md-type="navigation" >
 169                 <div class="md-sidebar__scrollwrap">
 170                   <div class="md-sidebar__inner">
 171
 172
 173
 174
 175
 176 <nav class="md-nav md-nav--primary" aria-label="Navigation" data-md-level="0">
 177   <label class="md-nav__title" for="__drawer">
 178     <a href="../../.." title="WoltLab Suite Documentation" class="md-nav__button md-logo" aria-label="WoltLab Suite Documentation">
 179
 180   <img src="../../../assets/logo.png" alt="logo">
 181
 182     </a>
 183     WoltLab Suite Documentation
 184   </label>
 185
 186     <div class="md-nav__source">
 187
 188 <a href="https://github.com/WoltLab/docs.woltlab.com/" title="Go to repository" class="md-source" data-md-component="source">
 189   <div class="md-source__icon md-icon">
 190
 191     <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><path d="M439.55 236.05L244 40.45a28.87 28.87 0 0 0-40.81 0l-40.66 40.63 51.52 51.52c27.06-9.14 52.68 16.77 43.39 43.68l49.66 49.66c34.23-11.8 61.18 31 35.47 56.69-26.49 26.49-70.21-2.87-56-37.34L240.22 199v121.85c25.3 12.54 22.26 41.85 9.08 55a34.34 34.34 0 0 1-48.55 0c-17.57-17.6-11.07-46.91 11.25-56v-123c-20.8-8.51-24.6-30.74-18.64-45L142.57 101 8.45 235.14a28.86 28.86 0 0 0 0 40.81l195.61 195.6a28.86 28.86 0 0 0 40.8 0l194.69-194.69a28.86 28.86 0 0 0 0-40.81z"/></svg>
 192   </div>
 193   <div class="md-source__repository">
 194     GitHub
 195   </div>
 196 </a>
 197     </div>
 198
 199   <ul class="md-nav__list" data-md-scrollfix>
 200
 201
 202
 203
 204
 205
 206
 207
 208     <li class="md-nav__item">
 209       <a href="../../../getting-started/" class="md-nav__link">
 210         Getting Started
 211       </a>
 212     </li>
 213
 214
 215
 216
 217
 218
 219
 220
 221
 222
 223
 224     <li class="md-nav__item md-nav__item--nested">
 225
 226
 227         <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_2" type="checkbox" id="__nav_2" >
 228
 229       <label class="md-nav__link" for="__nav_2">
 230         PHP API
 231         <span class="md-nav__icon md-icon"></span>
 232       </label>
 233       <nav class="md-nav" aria-label="PHP API" data-md-level="1">
 234         <label class="md-nav__title" for="__nav_2">
 235           <span class="md-nav__icon md-icon"></span>
 236           PHP API
 237         </label>
 238         <ul class="md-nav__list" data-md-scrollfix>
 239
 240
 241
 242
 243
 244     <li class="md-nav__item">
 245       <a href="../../../php/pages/" class="md-nav__link">
 246         Pages
 247       </a>
 248     </li>
 249
 250
 251
 252
 253
 254
 255
 256     <li class="md-nav__item">
 257       <a href="../../../php/database-objects/" class="md-nav__link">
 258         Database Objects
 259       </a>
 260     </li>
 261
 262
 263
 264
 265
 266
 267
 268     <li class="md-nav__item">
 269       <a href="../../../php/database-access/" class="md-nav__link">
 270         Database Access
 271       </a>
 272     </li>
 273
 274
 275
 276
 277
 278
 279
 280     <li class="md-nav__item">
 281       <a href="../../../php/exceptions/" class="md-nav__link">
 282         Exceptions
 283       </a>
 284     </li>
 285
 286
 287
 288
 289
 290
 291
 292
 293     <li class="md-nav__item md-nav__item--nested">
 294
 295
 296         <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_2_5" type="checkbox" id="__nav_2_5" >
 297
 298       <label class="md-nav__link" for="__nav_2_5">
 299         API
 300         <span class="md-nav__icon md-icon"></span>
 301       </label>
 302       <nav class="md-nav" aria-label="API" data-md-level="2">
 303         <label class="md-nav__title" for="__nav_2_5">
 304           <span class="md-nav__icon md-icon"></span>
 305           API
 306         </label>
 307         <ul class="md-nav__list" data-md-scrollfix>
 308
 309
 310
 311
 312
 313     <li class="md-nav__item">
 314       <a href="../../../php/api/caches/" class="md-nav__link">
 315         Caches
 316       </a>
 317     </li>
 318
 319
 320
 321
 322
 323
 324
 325     <li class="md-nav__item">
 326       <a href="../../../php/api/comments/" class="md-nav__link">
 327         Comments
 328       </a>
 329     </li>
 330
 331
 332
 333
 334
 335
 336
 337     <li class="md-nav__item">
 338       <a href="../../../php/api/cronjobs/" class="md-nav__link">
 339         Cronjobs
 340       </a>
 341     </li>
 342
 343
 344
 345
 346
 347
 348
 349     <li class="md-nav__item">
 350       <a href="../../../php/api/events/" class="md-nav__link">
 351         Events
 352       </a>
 353     </li>
 354
 355
 356
 357
 358
 359
 360
 361
 362     <li class="md-nav__item md-nav__item--nested">
 363
 364
 365         <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_2_5_5" type="checkbox" id="__nav_2_5_5" >
 366
 367       <label class="md-nav__link" for="__nav_2_5_5">
 368         Form Builder
 369         <span class="md-nav__icon md-icon"></span>
 370       </label>
 371       <nav class="md-nav" aria-label="Form Builder" data-md-level="3">
 372         <label class="md-nav__title" for="__nav_2_5_5">
 373           <span class="md-nav__icon md-icon"></span>
 374           Form Builder
 375         </label>
 376         <ul class="md-nav__list" data-md-scrollfix>
 377
 378
 379
 380
 381
 382     <li class="md-nav__item">
 383       <a href="../../../php/api/form_builder/overview/" class="md-nav__link">
 384         Overview
 385       </a>
 386     </li>
 387
 388
 389
 390
 391
 392
 393
 394     <li class="md-nav__item">
 395       <a href="../../../php/api/form_builder/structure/" class="md-nav__link">
 396         Structure
 397       </a>
 398     </li>
 399
 400
 401
 402
 403
 404
 405
 406     <li class="md-nav__item">
 407       <a href="../../../php/api/form_builder/form_fields/" class="md-nav__link">
 408         Fields
 409       </a>
 410     </li>
 411
 412
 413
 414
 415
 416
 417
 418     <li class="md-nav__item">
 419       <a href="../../../php/api/form_builder/validation_data/" class="md-nav__link">
 420         Validation and Data
 421       </a>
 422     </li>
 423
 424
 425
 426
 427
 428
 429
 430     <li class="md-nav__item">
 431       <a href="../../../php/api/form_builder/dependencies/" class="md-nav__link">
 432         Dependencies
 433       </a>
 434     </li>
 435
 436
 437
 438         </ul>
 439       </nav>
 440     </li>
 441
 442
 443
 444
 445
 446
 447
 448     <li class="md-nav__item">
 449       <a href="../../../php/api/package_installation_plugins/" class="md-nav__link">
 450         Package Installation Plugins
 451       </a>
 452     </li>
 453
 454
 455
 456
 457
 458
 459
 460     <li class="md-nav__item">
 461       <a href="../../../php/api/user_activity_points/" class="md-nav__link">
 462         User Activity Points
 463       </a>
 464     </li>
 465
 466
 467
 468
 469
 470
 471
 472     <li class="md-nav__item">
 473       <a href="../../../php/api/user_notifications/" class="md-nav__link">
 474         User Notifications
 475       </a>
 476     </li>
 477
 478
 479
 480
 481
 482
 483
 484     <li class="md-nav__item">
 485       <a href="../../../php/api/sitemaps/" class="md-nav__link">
 486         Sitemaps
 487       </a>
 488     </li>
 489
 490
 491
 492         </ul>
 493       </nav>
 494     </li>
 495
 496
 497
 498
 499
 500
 501
 502     <li class="md-nav__item">
 503       <a href="../../../php/code-style/" class="md-nav__link">
 504         Code Style
 505       </a>
 506     </li>
 507
 508
 509
 510
 511
 512
 513
 514     <li class="md-nav__item">
 515       <a href="../../../php/apps/" class="md-nav__link">
 516         Apps
 517       </a>
 518     </li>
 519
 520
 521
 522
 523
 524
 525
 526     <li class="md-nav__item">
 527       <a href="../../../php/gdpr/" class="md-nav__link">
 528         GDPR
 529       </a>
 530     </li>
 531
 532
 533
 534         </ul>
 535       </nav>
 536     </li>
 537
 538
 539
 540
 541
 542
 543
 544
 545
 546
 547
 548     <li class="md-nav__item md-nav__item--nested">
 549
 550
 551         <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_3" type="checkbox" id="__nav_3" >
 552
 553       <label class="md-nav__link" for="__nav_3">
 554         Languages, Templates & CSS
 555         <span class="md-nav__icon md-icon"></span>
 556       </label>
 557       <nav class="md-nav" aria-label="Languages, Templates & CSS" data-md-level="1">
 558         <label class="md-nav__title" for="__nav_3">
 559           <span class="md-nav__icon md-icon"></span>
 560           Languages, Templates & CSS
 561         </label>
 562         <ul class="md-nav__list" data-md-scrollfix>
 563
 564
 565
 566
 567
 568     <li class="md-nav__item">
 569       <a href="../../../view/languages/" class="md-nav__link">
 570         Languages
 571       </a>
 572     </li>
 573
 574
 575
 576
 577
 578
 579
 580     <li class="md-nav__item">
 581       <a href="../../../view/templates/" class="md-nav__link">
 582         Templates
 583       </a>
 584     </li>
 585
 586
 587
 588
 589
 590
 591
 592     <li class="md-nav__item">
 593       <a href="../../../view/css/" class="md-nav__link">
 594         CSS
 595       </a>
 596     </li>
 597
 598
 599
 600         </ul>
 601       </nav>
 602     </li>
 603
 604
 605
 606
 607
 608
 609
 610
 611
 612
 613
 614     <li class="md-nav__item md-nav__item--nested">
 615
 616
 617         <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_4" type="checkbox" id="__nav_4" >
 618
 619       <label class="md-nav__link" for="__nav_4">
 620         JavaScript API
 621         <span class="md-nav__icon md-icon"></span>
 622       </label>
 623       <nav class="md-nav" aria-label="JavaScript API" data-md-level="1">
 624         <label class="md-nav__title" for="__nav_4">
 625           <span class="md-nav__icon md-icon"></span>
 626           JavaScript API
 627         </label>
 628         <ul class="md-nav__list" data-md-scrollfix>
 629
 630
 631
 632
 633
 634     <li class="md-nav__item">
 635       <a href="../../../javascript/general-usage/" class="md-nav__link">
 636         General Usage
 637       </a>
 638     </li>
 639
 640
 641
 642
 643
 644
 645
 646
 647     <li class="md-nav__item md-nav__item--nested">
 648
 649
 650         <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_4_2" type="checkbox" id="__nav_4_2" >
 651
 652       <label class="md-nav__link" for="__nav_4_2">
 653         New API
 654         <span class="md-nav__icon md-icon"></span>
 655       </label>
 656       <nav class="md-nav" aria-label="New API" data-md-level="2">
 657         <label class="md-nav__title" for="__nav_4_2">
 658           <span class="md-nav__icon md-icon"></span>
 659           New API
 660         </label>
 661         <ul class="md-nav__list" data-md-scrollfix>
 662
 663
 664
 665
 666
 667     <li class="md-nav__item">
 668       <a href="../../../javascript/new-api_writing-a-module/" class="md-nav__link">
 669         Writing a module
 670       </a>
 671     </li>
 672
 673
 674
 675
 676
 677
 678
 679     <li class="md-nav__item">
 680       <a href="../../../javascript/new-api_data-structures/" class="md-nav__link">
 681         Data Structures
 682       </a>
 683     </li>
 684
 685
 686
 687
 688
 689
 690
 691     <li class="md-nav__item">
 692       <a href="../../../javascript/new-api_core/" class="md-nav__link">
 693         Core Functions
 694       </a>
 695     </li>
 696
 697
 698
 699
 700
 701
 702
 703     <li class="md-nav__item">
 704       <a href="../../../javascript/new-api_dom/" class="md-nav__link">
 705         DOM
 706       </a>
 707     </li>
 708
 709
 710
 711
 712
 713
 714
 715     <li class="md-nav__item">
 716       <a href="../../../javascript/new-api_events/" class="md-nav__link">
 717         Event Handling
 718       </a>
 719     </li>
 720
 721
 722
 723
 724
 725
 726
 727     <li class="md-nav__item">
 728       <a href="../../../javascript/new-api_ajax/" class="md-nav__link">
 729         Ajax
 730       </a>
 731     </li>
 732
 733
 734
 735
 736
 737
 738
 739     <li class="md-nav__item">
 740       <a href="../../../javascript/new-api_dialogs/" class="md-nav__link">
 741         Dialogs
 742       </a>
 743     </li>
 744
 745
 746
 747
 748
 749
 750
 751     <li class="md-nav__item">
 752       <a href="../../../javascript/new-api_browser/" class="md-nav__link">
 753         Browser and Screen Sizes
 754       </a>
 755     </li>
 756
 757
 758
 759
 760
 761
 762
 763     <li class="md-nav__item">
 764       <a href="../../../javascript/new-api_ui/" class="md-nav__link">
 765         User Interface
 766       </a>
 767     </li>
 768
 769
 770
 771         </ul>
 772       </nav>
 773     </li>
 774
 775
 776
 777
 778
 779
 780
 781     <li class="md-nav__item">
 782       <a href="../../../javascript/legacy-api/" class="md-nav__link">
 783         Legacy API
 784       </a>
 785     </li>
 786
 787
 788
 789
 790
 791
 792
 793     <li class="md-nav__item">
 794       <a href="../../../javascript/helper-functions/" class="md-nav__link">
 795         Helper Functions
 796       </a>
 797     </li>
 798
 799
 800
 801
 802
 803
 804
 805     <li class="md-nav__item">
 806       <a href="../../../javascript/code-snippets/" class="md-nav__link">
 807         Code Snippets
 808       </a>
 809     </li>
 810
 811
 812
 813         </ul>
 814       </nav>
 815     </li>
 816
 817
 818
 819
 820
 821
 822
 823
 824
 825
 826
 827     <li class="md-nav__item md-nav__item--nested">
 828
 829
 830         <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_5" type="checkbox" id="__nav_5" >
 831
 832       <label class="md-nav__link" for="__nav_5">
 833         Package Components
 834         <span class="md-nav__icon md-icon"></span>
 835       </label>
 836       <nav class="md-nav" aria-label="Package Components" data-md-level="1">
 837         <label class="md-nav__title" for="__nav_5">
 838           <span class="md-nav__icon md-icon"></span>
 839           Package Components
 840         </label>
 841         <ul class="md-nav__list" data-md-scrollfix>
 842
 843
 844
 845
 846
 847     <li class="md-nav__item">
 848       <a href="../../../package/package-xml/" class="md-nav__link">
 849         package.xml
 850       </a>
 851     </li>
 852
 853
 854
 855
 856
 857
 858
 859
 860     <li class="md-nav__item md-nav__item--nested">
 861
 862
 863         <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_5_2" type="checkbox" id="__nav_5_2" >
 864
 865       <label class="md-nav__link" for="__nav_5_2">
 866         PIPs
 867         <span class="md-nav__icon md-icon"></span>
 868       </label>
 869       <nav class="md-nav" aria-label="PIPs" data-md-level="2">
 870         <label class="md-nav__title" for="__nav_5_2">
 871           <span class="md-nav__icon md-icon"></span>
 872           PIPs
 873         </label>
 874         <ul class="md-nav__list" data-md-scrollfix>
 875
 876
 877
 878
 879
 880     <li class="md-nav__item">
 881       <a href="../../../package/pip/" class="md-nav__link">
 882         Overview
 883       </a>
 884     </li>
 885
 886
 887
 888
 889
 890
 891
 892     <li class="md-nav__item">
 893       <a href="../../../package/pip/acl-option/" class="md-nav__link">
 894         aclOption
 895       </a>
 896     </li>
 897
 898
 899
 900
 901
 902
 903
 904     <li class="md-nav__item">
 905       <a href="../../../package/pip/acp-menu/" class="md-nav__link">
 906         acpMenu
 907       </a>
 908     </li>
 909
 910
 911
 912
 913
 914
 915
 916     <li class="md-nav__item">
 917       <a href="../../../package/pip/acp-search-provider/" class="md-nav__link">
 918         acpSearchProvider
 919       </a>
 920     </li>
 921
 922
 923
 924
 925
 926
 927
 928     <li class="md-nav__item">
 929       <a href="../../../package/pip/acp-template/" class="md-nav__link">
 930         acpTemplate
 931       </a>
 932     </li>
 933
 934
 935
 936
 937
 938
 939
 940     <li class="md-nav__item">
 941       <a href="../../../package/pip/bbcode/" class="md-nav__link">
 942         bbcode
 943       </a>
 944     </li>
 945
 946
 947
 948
 949
 950
 951
 952     <li class="md-nav__item">
 953       <a href="../../../package/pip/box/" class="md-nav__link">
 954         box
 955       </a>
 956     </li>
 957
 958
 959
 960
 961
 962
 963
 964     <li class="md-nav__item">
 965       <a href="../../../package/pip/clipboard-action/" class="md-nav__link">
 966         clipboardAction
 967       </a>
 968     </li>
 969
 970
 971
 972
 973
 974
 975
 976     <li class="md-nav__item">
 977       <a href="../../../package/pip/core-object/" class="md-nav__link">
 978         coreObject
 979       </a>
 980     </li>
 981
 982
 983
 984
 985
 986
 987
 988     <li class="md-nav__item">
 989       <a href="../../../package/pip/cronjob/" class="md-nav__link">
 990         cronjob
 991       </a>
 992     </li>
 993
 994
 995
 996
 997
 998
 999
1000     <li class="md-nav__item">
1001       <a href="../../../package/pip/event-listener/" class="md-nav__link">
1002         eventListener
1003       </a>
1004     </li>
1005
1006
1007
1008
1009
1010
1011
1012     <li class="md-nav__item">
1013       <a href="../../../package/pip/file/" class="md-nav__link">
1014         file
1015       </a>
1016     </li>
1017
1018
1019
1020
1021
1022
1023
1024     <li class="md-nav__item">
1025       <a href="../../../package/pip/language/" class="md-nav__link">
1026         language
1027       </a>
1028     </li>
1029
1030
1031
1032
1033
1034
1035
1036     <li class="md-nav__item">
1037       <a href="../../../package/pip/media-provider/" class="md-nav__link">
1038         mediaProvider
1039       </a>
1040     </li>
1041
1042
1043
1044
1045
1046
1047
1048     <li class="md-nav__item">
1049       <a href="../../../package/pip/menu/" class="md-nav__link">
1050         menu
1051       </a>
1052     </li>
1053
1054
1055
1056
1057
1058
1059
1060     <li class="md-nav__item">
1061       <a href="../../../package/pip/menu-item/" class="md-nav__link">
1062         menuItem
1063       </a>
1064     </li>
1065
1066
1067
1068
1069
1070
1071
1072     <li class="md-nav__item">
1073       <a href="../../../package/pip/object-type/" class="md-nav__link">
1074         objectType
1075       </a>
1076     </li>
1077
1078
1079
1080
1081
1082
1083
1084     <li class="md-nav__item">
1085       <a href="../../../package/pip/object-type-definition/" class="md-nav__link">
1086         objectTypeDefinition
1087       </a>
1088     </li>
1089
1090
1091
1092
1093
1094
1095
1096     <li class="md-nav__item">
1097       <a href="../../../package/pip/option/" class="md-nav__link">
1098         option
1099       </a>
1100     </li>
1101
1102
1103
1104
1105
1106
1107
1108     <li class="md-nav__item">
1109       <a href="../../../package/pip/page/" class="md-nav__link">
1110         page
1111       </a>
1112     </li>
1113
1114
1115
1116
1117
1118
1119
1120     <li class="md-nav__item">
1121       <a href="../../../package/pip/pip/" class="md-nav__link">
1122         pip
1123       </a>
1124     </li>
1125
1126
1127
1128
1129
1130
1131
1132     <li class="md-nav__item">
1133       <a href="../../../package/pip/script/" class="md-nav__link">
1134         script
1135       </a>
1136     </li>
1137
1138
1139
1140
1141
1142
1143
1144     <li class="md-nav__item">
1145       <a href="../../../package/pip/smiley/" class="md-nav__link">
1146         smiley
1147       </a>
1148     </li>
1149
1150
1151
1152
1153
1154
1155
1156     <li class="md-nav__item">
1157       <a href="../../../package/pip/sql/" class="md-nav__link">
1158         sql
1159       </a>
1160     </li>
1161
1162
1163
1164
1165
1166
1167
1168     <li class="md-nav__item">
1169       <a href="../../../package/pip/style/" class="md-nav__link">
1170         style
1171       </a>
1172     </li>
1173
1174
1175
1176
1177
1178
1179
1180     <li class="md-nav__item">
1181       <a href="../../../package/pip/template/" class="md-nav__link">
1182         template
1183       </a>
1184     </li>
1185
1186
1187
1188
1189
1190
1191
1192     <li class="md-nav__item">
1193       <a href="../../../package/pip/template-listener/" class="md-nav__link">
1194         templateListener
1195       </a>
1196     </li>
1197
1198
1199
1200
1201
1202
1203
1204     <li class="md-nav__item">
1205       <a href="../../../package/pip/user-group-option/" class="md-nav__link">
1206         userGroupOption
1207       </a>
1208     </li>
1209
1210
1211
1212
1213
1214
1215
1216     <li class="md-nav__item">
1217       <a href="../../../package/pip/user-menu/" class="md-nav__link">
1218         userMenu
1219       </a>
1220     </li>
1221
1222
1223
1224
1225
1226
1227
1228     <li class="md-nav__item">
1229       <a href="../../../package/pip/user-notification-event/" class="md-nav__link">
1230         userNotificationEvent
1231       </a>
1232     </li>
1233
1234
1235
1236
1237
1238
1239
1240     <li class="md-nav__item">
1241       <a href="../../../package/pip/user-option/" class="md-nav__link">
1242         userOption
1243       </a>
1244     </li>
1245
1246
1247
1248
1249
1250
1251
1252     <li class="md-nav__item">
1253       <a href="../../../package/pip/user-profile-menu/" class="md-nav__link">
1254         userProfileMenu
1255       </a>
1256     </li>
1257
1258
1259
1260         </ul>
1261       </nav>
1262     </li>
1263
1264
1265
1266
1267
1268
1269
1270     <li class="md-nav__item">
1271       <a href="../../../package/database-php-api/" class="md-nav__link">
1272         Database PHP API
1273       </a>
1274     </li>
1275
1276
1277
1278         </ul>
1279       </nav>
1280     </li>
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294     <li class="md-nav__item md-nav__item--active md-nav__item--nested">
1295
1296
1297         <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_6" type="checkbox" id="__nav_6" checked>
1298
1299       <label class="md-nav__link" for="__nav_6">
1300         Migration
1301         <span class="md-nav__icon md-icon"></span>
1302       </label>
1303       <nav class="md-nav" aria-label="Migration" data-md-level="1">
1304         <label class="md-nav__title" for="__nav_6">
1305           <span class="md-nav__icon md-icon"></span>
1306           Migration
1307         </label>
1308         <ul class="md-nav__list" data-md-scrollfix>
1309
1310
1311
1312
1313
1314
1315
1316
1317     <li class="md-nav__item md-nav__item--active md-nav__item--nested">
1318
1319
1320         <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_6_1" type="checkbox" id="__nav_6_1" checked>
1321
1322       <label class="md-nav__link" for="__nav_6_1">
1323         Migrating from WSC 5.3
1324         <span class="md-nav__icon md-icon"></span>
1325       </label>
1326       <nav class="md-nav" aria-label="Migrating from WSC 5.3" data-md-level="2">
1327         <label class="md-nav__title" for="__nav_6_1">
1328           <span class="md-nav__icon md-icon"></span>
1329           Migrating from WSC 5.3
1330         </label>
1331         <ul class="md-nav__list" data-md-scrollfix>
1332
1333
1334
1335
1336
1337     <li class="md-nav__item">
1338       <a href="../php/" class="md-nav__link">
1339         PHP API
1340       </a>
1341     </li>
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351     <li class="md-nav__item md-nav__item--active">
1352
1353       <input class="md-nav__toggle md-toggle" data-md-toggle="toc" type="checkbox" id="__toc">
1354
1355
1356
1357
1358         <label class="md-nav__link md-nav__link--active" for="__toc">
1359           Session Handling and Authentication
1360           <span class="md-nav__icon md-icon"></span>
1361         </label>
1362
1363       <a href="./" class="md-nav__link md-nav__link--active">
1364         Session Handling and Authentication
1365       </a>
1366
1367
1368 <nav class="md-nav md-nav--secondary" aria-label="Table of contents">
1369
1370
1371
1372
1373
1374     <label class="md-nav__title" for="__toc">
1375       <span class="md-nav__icon md-icon"></span>
1376       Table of contents
1377     </label>
1378     <ul class="md-nav__list" data-md-component="toc" data-md-scrollfix>
1379
1380         <li class="md-nav__item">
1381   <a href="#summary-and-concepts" class="md-nav__link">
1382     Summary and Concepts
1383   </a>
1384
1385     <nav class="md-nav" aria-label="Summary and Concepts">
1386       <ul class="md-nav__list">
1387
1388           <li class="md-nav__item">
1389   <a href="#legacy-persistent-login" class="md-nav__link">
1390     Legacy Persistent Login
1391   </a>
1392
1393 </li>
1394
1395           <li class="md-nav__item">
1396   <a href="#multiple-sessions" class="md-nav__link">
1397     Multiple Sessions
1398   </a>
1399
1400 </li>
1401
1402           <li class="md-nav__item">
1403   <a href="#merged-acp-and-frontend-sessions" class="md-nav__link">
1404     Merged ACP and Frontend Sessions
1405   </a>
1406
1407 </li>
1408
1409           <li class="md-nav__item">
1410   <a href="#improved-authentication-and-reauthentication" class="md-nav__link">
1411     Improved Authentication and Reauthentication
1412   </a>
1413
1414 </li>
1415
1416       </ul>
1417     </nav>
1418
1419 </li>
1420
1421         <li class="md-nav__item">
1422   <a href="#additions-and-changes" class="md-nav__link">
1423     Additions and Changes
1424   </a>
1425
1426     <nav class="md-nav" aria-label="Additions and Changes">
1427       <ul class="md-nav__list">
1428
1429           <li class="md-nav__item">
1430   <a href="#password-hashing" class="md-nav__link">
1431     Password Hashing
1432   </a>
1433
1434 </li>
1435
1436           <li class="md-nav__item">
1437   <a href="#session-storage" class="md-nav__link">
1438     Session Storage
1439   </a>
1440
1441 </li>
1442
1443           <li class="md-nav__item">
1444   <a href="#reauthentication" class="md-nav__link">
1445     Reauthentication
1446   </a>
1447
1448 </li>
1449
1450           <li class="md-nav__item">
1451   <a href="#multi-factor-authentication" class="md-nav__link">
1452     Multi-factor Authentication
1453   </a>
1454
1455     <nav class="md-nav" aria-label="Multi-factor Authentication">
1456       <ul class="md-nav__list">
1457
1458           <li class="md-nav__item">
1459   <a href="#adding-multi-factor-methods" class="md-nav__link">
1460     Adding Multi-factor Methods
1461   </a>
1462
1463 </li>
1464
1465       </ul>
1466     </nav>
1467
1468 </li>
1469
1470       </ul>
1471     </nav>
1472
1473 </li>
1474
1475         <li class="md-nav__item">
1476   <a href="#deprecations-and-removals" class="md-nav__link">
1477     Deprecations and Removals
1478   </a>
1479
1480     <nav class="md-nav" aria-label="Deprecations and Removals">
1481       <ul class="md-nav__list">
1482
1483           <li class="md-nav__item">
1484   <a href="#sessionhandler" class="md-nav__link">
1485     SessionHandler
1486   </a>
1487
1488 </li>
1489
1490           <li class="md-nav__item">
1491   <a href="#acp-sessions" class="md-nav__link">
1492     ACP Sessions
1493   </a>
1494
1495 </li>
1496
1497           <li class="md-nav__item">
1498   <a href="#cookies" class="md-nav__link">
1499     Cookies
1500   </a>
1501
1502 </li>
1503
1504           <li class="md-nav__item">
1505   <a href="#virtual-sessions" class="md-nav__link">
1506     Virtual Sessions
1507   </a>
1508
1509 </li>
1510
1511           <li class="md-nav__item">
1512   <a href="#security-token-constants" class="md-nav__link">
1513     Security Token Constants
1514   </a>
1515
1516 </li>
1517
1518           <li class="md-nav__item">
1519   <a href="#passwordutil-and-double-bcrypt-hashes" class="md-nav__link">
1520     PasswordUtil and Double BCrypt Hashes
1521   </a>
1522
1523 </li>
1524
1525       </ul>
1526     </nav>
1527
1528 </li>
1529
1530     </ul>
1531
1532 </nav>
1533
1534     </li>
1535
1536
1537
1538
1539
1540
1541
1542     <li class="md-nav__item">
1543       <a href="../javascript/" class="md-nav__link">
1544         JavaScript
1545       </a>
1546     </li>
1547
1548
1549
1550
1551
1552
1553
1554     <li class="md-nav__item">
1555       <a href="../templates/" class="md-nav__link">
1556         Templates
1557       </a>
1558     </li>
1559
1560
1561
1562
1563
1564
1565
1566     <li class="md-nav__item">
1567       <a href="../libraries/" class="md-nav__link">
1568         Third Party Libraries
1569       </a>
1570     </li>
1571
1572
1573
1574         </ul>
1575       </nav>
1576     </li>
1577
1578
1579
1580
1581
1582
1583
1584
1585     <li class="md-nav__item md-nav__item--nested">
1586
1587
1588         <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_6_2" type="checkbox" id="__nav_6_2" >
1589
1590       <label class="md-nav__link" for="__nav_6_2">
1591         Migrating from WSC 5.2
1592         <span class="md-nav__icon md-icon"></span>
1593       </label>
1594       <nav class="md-nav" aria-label="Migrating from WSC 5.2" data-md-level="2">
1595         <label class="md-nav__title" for="__nav_6_2">
1596           <span class="md-nav__icon md-icon"></span>
1597           Migrating from WSC 5.2
1598         </label>
1599         <ul class="md-nav__list" data-md-scrollfix>
1600
1601
1602
1603
1604
1605     <li class="md-nav__item">
1606       <a href="../../wsc52/php/" class="md-nav__link">
1607         PHP API
1608       </a>
1609     </li>
1610
1611
1612
1613
1614
1615
1616
1617     <li class="md-nav__item">
1618       <a href="../../wsc52/templates/" class="md-nav__link">
1619         Templates and Languages
1620       </a>
1621     </li>
1622
1623
1624
1625
1626
1627
1628
1629     <li class="md-nav__item">
1630       <a href="../../wsc52/libraries/" class="md-nav__link">
1631         Third Party Libraries
1632       </a>
1633     </li>
1634
1635
1636
1637         </ul>
1638       </nav>
1639     </li>
1640
1641
1642
1643
1644
1645
1646
1647
1648     <li class="md-nav__item md-nav__item--nested">
1649
1650
1651         <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_6_3" type="checkbox" id="__nav_6_3" >
1652
1653       <label class="md-nav__link" for="__nav_6_3">
1654         Migrating from WSC 3.1
1655         <span class="md-nav__icon md-icon"></span>
1656       </label>
1657       <nav class="md-nav" aria-label="Migrating from WSC 3.1" data-md-level="2">
1658         <label class="md-nav__title" for="__nav_6_3">
1659           <span class="md-nav__icon md-icon"></span>
1660           Migrating from WSC 3.1
1661         </label>
1662         <ul class="md-nav__list" data-md-scrollfix>
1663
1664
1665
1666
1667
1668     <li class="md-nav__item">
1669       <a href="../../wsc31/php/" class="md-nav__link">
1670         PHP API
1671       </a>
1672     </li>
1673
1674
1675
1676         </ul>
1677       </nav>
1678     </li>
1679
1680
1681
1682
1683
1684
1685
1686
1687     <li class="md-nav__item md-nav__item--nested">
1688
1689
1690         <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_6_4" type="checkbox" id="__nav_6_4" >
1691
1692       <label class="md-nav__link" for="__nav_6_4">
1693         Migrating from WSC 3.0
1694         <span class="md-nav__icon md-icon"></span>
1695       </label>
1696       <nav class="md-nav" aria-label="Migrating from WSC 3.0" data-md-level="2">
1697         <label class="md-nav__title" for="__nav_6_4">
1698           <span class="md-nav__icon md-icon"></span>
1699           Migrating from WSC 3.0
1700         </label>
1701         <ul class="md-nav__list" data-md-scrollfix>
1702
1703
1704
1705
1706
1707     <li class="md-nav__item">
1708       <a href="../../wsc30/php/" class="md-nav__link">
1709         PHP API
1710       </a>
1711     </li>
1712
1713
1714
1715
1716
1717
1718
1719     <li class="md-nav__item">
1720       <a href="../../wsc30/javascript/" class="md-nav__link">
1721         JavaScript API
1722       </a>
1723     </li>
1724
1725
1726
1727
1728
1729
1730
1731     <li class="md-nav__item">
1732       <a href="../../wsc30/templates/" class="md-nav__link">
1733         Templates
1734       </a>
1735     </li>
1736
1737
1738
1739
1740
1741
1742
1743     <li class="md-nav__item">
1744       <a href="../../wsc30/css/" class="md-nav__link">
1745         CSS
1746       </a>
1747     </li>
1748
1749
1750
1751
1752
1753
1754
1755     <li class="md-nav__item">
1756       <a href="../../wsc30/package/" class="md-nav__link">
1757         Package Components
1758       </a>
1759     </li>
1760
1761
1762
1763         </ul>
1764       </nav>
1765     </li>
1766
1767
1768
1769
1770
1771
1772
1773
1774     <li class="md-nav__item md-nav__item--nested">
1775
1776
1777         <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_6_5" type="checkbox" id="__nav_6_5" >
1778
1779       <label class="md-nav__link" for="__nav_6_5">
1780         Migrating from WCF 2.1
1781         <span class="md-nav__icon md-icon"></span>
1782       </label>
1783       <nav class="md-nav" aria-label="Migrating from WCF 2.1" data-md-level="2">
1784         <label class="md-nav__title" for="__nav_6_5">
1785           <span class="md-nav__icon md-icon"></span>
1786           Migrating from WCF 2.1
1787         </label>
1788         <ul class="md-nav__list" data-md-scrollfix>
1789
1790
1791
1792
1793
1794     <li class="md-nav__item">
1795       <a href="../../wcf21/php/" class="md-nav__link">
1796         PHP API
1797       </a>
1798     </li>
1799
1800
1801
1802
1803
1804
1805
1806     <li class="md-nav__item">
1807       <a href="../../wcf21/templates/" class="md-nav__link">
1808         Templates
1809       </a>
1810     </li>
1811
1812
1813
1814
1815
1816
1817
1818     <li class="md-nav__item">
1819       <a href="../../wcf21/css/" class="md-nav__link">
1820         CSS
1821       </a>
1822     </li>
1823
1824
1825
1826
1827
1828
1829
1830     <li class="md-nav__item">
1831       <a href="../../wcf21/package/" class="md-nav__link">
1832         Package Components
1833       </a>
1834     </li>
1835
1836
1837
1838         </ul>
1839       </nav>
1840     </li>
1841
1842
1843
1844         </ul>
1845       </nav>
1846     </li>
1847
1848
1849
1850
1851
1852
1853
1854
1855
1856
1857
1858     <li class="md-nav__item md-nav__item--nested">
1859
1860
1861         <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_7" type="checkbox" id="__nav_7" >
1862
1863       <label class="md-nav__link" for="__nav_7">
1864         Tutorials
1865         <span class="md-nav__icon md-icon"></span>
1866       </label>
1867       <nav class="md-nav" aria-label="Tutorials" data-md-level="1">
1868         <label class="md-nav__title" for="__nav_7">
1869           <span class="md-nav__icon md-icon"></span>
1870           Tutorials
1871         </label>
1872         <ul class="md-nav__list" data-md-scrollfix>
1873
1874
1875
1876
1877
1878
1879     <li class="md-nav__item md-nav__item--nested">
1880
1881
1882         <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_7_1" type="checkbox" id="__nav_7_1" >
1883
1884       <label class="md-nav__link" for="__nav_7_1">
1885         Tutorial Series
1886         <span class="md-nav__icon md-icon"></span>
1887       </label>
1888       <nav class="md-nav" aria-label="Tutorial Series" data-md-level="2">
1889         <label class="md-nav__title" for="__nav_7_1">
1890           <span class="md-nav__icon md-icon"></span>
1891           Tutorial Series
1892         </label>
1893         <ul class="md-nav__list" data-md-scrollfix>
1894
1895
1896
1897
1898
1899     <li class="md-nav__item">
1900       <a href="../../../tutorial/series/overview/" class="md-nav__link">
1901         Overview
1902       </a>
1903     </li>
1904
1905
1906
1907
1908
1909
1910
1911     <li class="md-nav__item">
1912       <a href="../../../tutorial/series/part_1/" class="md-nav__link">
1913         Part 1
1914       </a>
1915     </li>
1916
1917
1918
1919
1920
1921
1922
1923     <li class="md-nav__item">
1924       <a href="../../../tutorial/series/part_2/" class="md-nav__link">
1925         Part 2
1926       </a>
1927     </li>
1928
1929
1930
1931
1932
1933
1934
1935     <li class="md-nav__item">
1936       <a href="../../../tutorial/series/part_3/" class="md-nav__link">
1937         Part 3
1938       </a>
1939     </li>
1940
1941
1942
1943         </ul>
1944       </nav>
1945     </li>
1946
1947
1948
1949         </ul>
1950       </nav>
1951     </li>
1952
1953
1954
1955   </ul>
1956 </nav>
1957                   </div>
1958                 </div>
1959               </div>
1960
1961
1962
1963               <div class="md-sidebar md-sidebar--secondary" data-md-component="sidebar" data-md-type="toc" >
1964                 <div class="md-sidebar__scrollwrap">
1965                   <div class="md-sidebar__inner">
1966
1967 <nav class="md-nav md-nav--secondary" aria-label="Table of contents">
1968
1969
1970
1971
1972
1973     <label class="md-nav__title" for="__toc">
1974       <span class="md-nav__icon md-icon"></span>
1975       Table of contents
1976     </label>
1977     <ul class="md-nav__list" data-md-component="toc" data-md-scrollfix>
1978
1979         <li class="md-nav__item">
1980   <a href="#summary-and-concepts" class="md-nav__link">
1981     Summary and Concepts
1982   </a>
1983
1984     <nav class="md-nav" aria-label="Summary and Concepts">
1985       <ul class="md-nav__list">
1986
1987           <li class="md-nav__item">
1988   <a href="#legacy-persistent-login" class="md-nav__link">
1989     Legacy Persistent Login
1990   </a>
1991
1992 </li>
1993
1994           <li class="md-nav__item">
1995   <a href="#multiple-sessions" class="md-nav__link">
1996     Multiple Sessions
1997   </a>
1998
1999 </li>
2000
2001           <li class="md-nav__item">
2002   <a href="#merged-acp-and-frontend-sessions" class="md-nav__link">
2003     Merged ACP and Frontend Sessions
2004   </a>
2005
2006 </li>
2007
2008           <li class="md-nav__item">
2009   <a href="#improved-authentication-and-reauthentication" class="md-nav__link">
2010     Improved Authentication and Reauthentication
2011   </a>
2012
2013 </li>
2014
2015       </ul>
2016     </nav>
2017
2018 </li>
2019
2020         <li class="md-nav__item">
2021   <a href="#additions-and-changes" class="md-nav__link">
2022     Additions and Changes
2023   </a>
2024
2025     <nav class="md-nav" aria-label="Additions and Changes">
2026       <ul class="md-nav__list">
2027
2028           <li class="md-nav__item">
2029   <a href="#password-hashing" class="md-nav__link">
2030     Password Hashing
2031   </a>
2032
2033 </li>
2034
2035           <li class="md-nav__item">
2036   <a href="#session-storage" class="md-nav__link">
2037     Session Storage
2038   </a>
2039
2040 </li>
2041
2042           <li class="md-nav__item">
2043   <a href="#reauthentication" class="md-nav__link">
2044     Reauthentication
2045   </a>
2046
2047 </li>
2048
2049           <li class="md-nav__item">
2050   <a href="#multi-factor-authentication" class="md-nav__link">
2051     Multi-factor Authentication
2052   </a>
2053
2054     <nav class="md-nav" aria-label="Multi-factor Authentication">
2055       <ul class="md-nav__list">
2056
2057           <li class="md-nav__item">
2058   <a href="#adding-multi-factor-methods" class="md-nav__link">
2059     Adding Multi-factor Methods
2060   </a>
2061
2062 </li>
2063
2064       </ul>
2065     </nav>
2066
2067 </li>
2068
2069       </ul>
2070     </nav>
2071
2072 </li>
2073
2074         <li class="md-nav__item">
2075   <a href="#deprecations-and-removals" class="md-nav__link">
2076     Deprecations and Removals
2077   </a>
2078
2079     <nav class="md-nav" aria-label="Deprecations and Removals">
2080       <ul class="md-nav__list">
2081
2082           <li class="md-nav__item">
2083   <a href="#sessionhandler" class="md-nav__link">
2084     SessionHandler
2085   </a>
2086
2087 </li>
2088
2089           <li class="md-nav__item">
2090   <a href="#acp-sessions" class="md-nav__link">
2091     ACP Sessions
2092   </a>
2093
2094 </li>
2095
2096           <li class="md-nav__item">
2097   <a href="#cookies" class="md-nav__link">
2098     Cookies
2099   </a>
2100
2101 </li>
2102
2103           <li class="md-nav__item">
2104   <a href="#virtual-sessions" class="md-nav__link">
2105     Virtual Sessions
2106   </a>
2107
2108 </li>
2109
2110           <li class="md-nav__item">
2111   <a href="#security-token-constants" class="md-nav__link">
2112     Security Token Constants
2113   </a>
2114
2115 </li>
2116
2117           <li class="md-nav__item">
2118   <a href="#passwordutil-and-double-bcrypt-hashes" class="md-nav__link">
2119     PasswordUtil and Double BCrypt Hashes
2120   </a>
2121
2122 </li>
2123
2124       </ul>
2125     </nav>
2126
2127 </li>
2128
2129     </ul>
2130
2131 </nav>
2132                   </div>
2133                 </div>
2134               </div>
2135
2136
2137           <div class="md-content" data-md-component="content">
2138             <article class="md-content__inner md-typeset">
2139
2140
2141                   <a href="https://github.com/WoltLab/docs.woltlab.com/edit/5.4/docs/migration/wsc53/session.md" title="Edit this page" class="md-content__button md-icon">
2142                     <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M20.71 7.04c.39-.39.39-1.04 0-1.41l-2.34-2.34c-.37-.39-1.02-.39-1.41 0l-1.84 1.83 3.75 3.75M3 17.25V21h3.75L17.81 9.93l-3.75-3.75L3 17.25z"/></svg>
2143                   </a>
2144
2145
2146                 <h1 id="migrating-from-wsc-53-session-handling-and-authentication">Migrating from WSC 5.3 - Session Handling and Authentication<a class="headerlink" href="#migrating-from-wsc-53-session-handling-and-authentication" title="Permanent link">#</a></h1>
2147 <p>WoltLab Suite 5.4 includes a completely refactored session handling.
2148 As long as you only interact with sessions via <code>WCF::getSession()</code>, especially when you perform read-only accesses, you should not notice any breaking changes.</p>
2149 <p>You might appreciate some of the new session methods if you process security sensitive data.</p>
2150 <h2 id="summary-and-concepts">Summary and Concepts<a class="headerlink" href="#summary-and-concepts" title="Permanent link">#</a></h2>
2151 <p>Most of the changes revolve around the removal of the legacy persistent login functionality and the assumption that every user has a single session only.
2152 Both aspects are related to each other.</p>
2153 <h3 id="legacy-persistent-login">Legacy Persistent Login<a class="headerlink" href="#legacy-persistent-login" title="Permanent link">#</a></h3>
2154 <p>The legacy persistent login was rather an automated login.
2155 Upon bootstrapping a session, it was checked whether the user had a cookie pair storing the user’s <code>userID</code> and (a single BCrypt hash of) the user’s password.
2156 If such a cookie pair exists and the BCrypt hash within the cookie matches the user’s password hash when hashed again, the session would immediately <code>changeUser()</code> to the respective user.</p>
2157 <p>This legacy persistent login was completely removed.
2158 Instead, any sessions that belong to an authenticated user will automatically be long-lived.
2159 These long-lived sessions expire no sooner than 14 days after the last activity, ensuring that the user continously stays logged in, provided that they visit the page at least once per fortnight.</p>
2160 <h3 id="multiple-sessions">Multiple Sessions<a class="headerlink" href="#multiple-sessions" title="Permanent link">#</a></h3>
2161 <p>To allow for a proper separation of these long-lived user sessions, WoltLab Suite now allows for multiple sessions per user.
2162 These sessions are completely unrelated to each other.
2163 Specifically, they do not share session variables and they expire independently.</p>
2164 <p>As the existing <code>wcf1_session</code> table is also used for the online lists and location tracking, it will be maintained on a best effort basis.
2165 It no longer stores any private session data.</p>
2166 <p>The actual sessions storing security sensitive information are in an unrelated location.
2167 They must only be accessed via the PHP API exposed by the <code>SessionHandler</code>.</p>
2168 <h3 id="merged-acp-and-frontend-sessions">Merged ACP and Frontend Sessions<a class="headerlink" href="#merged-acp-and-frontend-sessions" title="Permanent link">#</a></h3>
2169 <p>WoltLab Suite 5.4 shares a single session across both the frontend, as well as the ACP.
2170 When a user logs in to the frontend, they will also be logged into the ACP and vice versa.</p>
2171 <p>Actual access to the ACP is controlled via the new <a href="#reauthentication">reauthentication mechanism</a>.</p>
2172 <p>The session variable store is scoped:
2173 Session variables set within the frontend are not available within the ACP and vice versa.</p>
2174 <h3 id="improved-authentication-and-reauthentication">Improved Authentication and Reauthentication<a class="headerlink" href="#improved-authentication-and-reauthentication" title="Permanent link">#</a></h3>
2175 <p>WoltLab Suite 5.4 ships with multi-factor authentication support and a generic re-authentication implementation that can be used to verify the account owner’s presence.</p>
2176 <h2 id="additions-and-changes">Additions and Changes<a class="headerlink" href="#additions-and-changes" title="Permanent link">#</a></h2>
2177 <h3 id="password-hashing">Password Hashing<a class="headerlink" href="#password-hashing" title="Permanent link">#</a></h3>
2178 <p>WoltLab Suite 5.4 includes a new object-oriented password hashing framework that is modeled after PHP’s <code>password_*</code> API.
2179 Check <a href="https://github.com/WoltLab/WCF/blob/master/wcfsetup/install/files/lib/system/user/authentication/password/PasswordAlgorithmManager.class.php"><code>PasswordAlgorithmManager</code></a> and <a href="https://github.com/WoltLab/WCF/blob/master/wcfsetup/install/files/lib/system/user/authentication/password/IPasswordAlgorithm.class.php"><code>IPasswordAlgorithm</code></a> for details.</p>
2180 <p>The new default password hash is a standard BCrypt hash.
2181 All newly generated hashes in <code>wcf1_user.password</code> will now include a type prefix, instead of just passwords imported from other systems.</p>
2182 <h3 id="session-storage">Session Storage<a class="headerlink" href="#session-storage" title="Permanent link">#</a></h3>
2183 <p>The <code>wcf1_session</code> table will no longer be used for session storage.
2184 Instead, it is maintained for compatibility with existing online lists.</p>
2185 <p>The actual session storage is considered an implementation detail and you <em>must not</em> directly interact with the session tables.
2186 Future versions might support alternative session backends, such as Redis.</p>
2187 <div class="admonition warning">
2188 <p class="admonition-title">Do not interact directly with the session database tables but only via the <code>SessionHandler</code> class!</p>
2189 </div>
2190 <h3 id="reauthentication">Reauthentication<a class="headerlink" href="#reauthentication" title="Permanent link">#</a></h3>
2191 <p>For security sensitive processing, you might want to ensure that the account owner is actually present instead of a third party accessing a session that was accidentally left logged in.</p>
2192 <p>WoltLab Suite 5.4 ships with a generic reauthentication framework.
2193 To request reauthentication within your controller you need to:</p>
2194 <ol>
2195 <li>Use the <code>wcf\system\user\authentication\TReauthenticationCheck</code> trait.</li>
2196 <li>Call:
2197    <div class="highlight"><pre><span></span><code><span class="nv">$this</span><span class="o">-&gt;</span><span class="na">requestReauthentication</span><span class="p">(</span><span class="nx">LinkHandler</span><span class="o">::</span><span class="na">getInstance</span><span class="p">()</span><span class="o">-&gt;</span><span class="na">getControllerLink</span><span class="p">(</span><span class="k">static</span><span class="o">::</span><span class="na">class</span><span class="p">,</span> <span class="p">[</span>
2198  <span class="cm">/* additional parameters */</span>
2199 <span class="p">]));</span>
2200 </code></pre></div></li>
2201 </ol>
2202 <p><code>requestReauthentication()</code> will check if the user has recently authenticated themselves.
2203 If they did, the request proceeds as usual.
2204 Otherwise, they will be asked to reauthenticate themselves.
2205 After the successful authentication, they will be redirected to the URL that was passed as the first parameter (the current controller within the example).</p>
2206 <p>Details can be found in <a href="https://github.com/WoltLab/WCF/pull/3775">WoltLab/WCF#3775</a>.</p>
2207 <h3 id="multi-factor-authentication">Multi-factor Authentication<a class="headerlink" href="#multi-factor-authentication" title="Permanent link">#</a></h3>
2208 <p>To implement multi-factor authentication securely, WoltLab Suite 5.4 implements the concept of a “pending user change”.
2209 The user will not be logged in (i.e. <code>WCF::getUser()-&gt;userID</code> returns <code>null</code>) until they authenticate themselves with their second factor.</p>
2210 <p>Requesting multi-factor authentication is done on an opt-in basis for compatibility reasons.
2211 If you perform authentication yourself and do not trust the authentication source to perform multi-factor authentication itself, you will need to adjust your logic to request multi-factor authentication from WoltLab Suite:</p>
2212 <p>Previously:</p>
2213 <div class="highlight"><pre><span></span><code><span class="nx">WCF</span><span class="o">::</span><span class="na">getSession</span><span class="p">()</span><span class="o">-&gt;</span><span class="na">changeUser</span><span class="p">(</span><span class="nv">$targetUser</span><span class="p">);</span>
2214 </code></pre></div>
2215 <p>Now:</p>
2216 <div class="highlight"><pre><span></span><code><span class="nv">$isPending</span> <span class="o">=</span> <span class="nx">WCF</span><span class="o">::</span><span class="na">getSession</span><span class="p">()</span><span class="o">-&gt;</span><span class="na">changeUserAfterMultifactorAuthentication</span><span class="p">(</span><span class="nv">$targetUser</span><span class="p">);</span>
2217 <span class="k">if</span> <span class="p">(</span><span class="nv">$isPending</span><span class="p">)</span> <span class="p">{</span>
2218     <span class="c1">// Redirect to the authentication form. The user will not be logged in.</span>
2219     <span class="c1">// Note: Do not use `getControllerLink` to support both the frontend as well as the ACP.</span>
2220     <span class="nx">HeaderUtil</span><span class="o">::</span><span class="na">redirect</span><span class="p">(</span><span class="nx">LinkHandler</span><span class="o">::</span><span class="na">getInstance</span><span class="p">()</span><span class="o">-&gt;</span><span class="na">getLink</span><span class="p">(</span><span class="s1">&#39;MultifactorAuthentication&#39;</span><span class="p">,</span> <span class="p">[</span>
2221         <span class="s1">&#39;url&#39;</span> <span class="o">=&gt;</span> <span class="cm">/* Return To */</span><span class="p">,</span>
2222     <span class="p">]));</span>
2223     <span class="k">exit</span><span class="p">;</span>
2224 <span class="p">}</span>
2225 <span class="c1">// Proceed as usual. The user will be logged in.</span>
2226 </code></pre></div>
2227 <h4 id="adding-multi-factor-methods">Adding Multi-factor Methods<a class="headerlink" href="#adding-multi-factor-methods" title="Permanent link">#</a></h4>
2228 <p>Adding your own multi-factor method requires the implementation of a single object type:</p>
2229 <div class="highlight"><pre><span></span><code><span class="nt">&lt;type&gt;</span>
2230     <span class="nt">&lt;name&gt;</span>com.example.multifactor.foobar<span class="nt">&lt;/name&gt;</span>
2231     <span class="nt">&lt;definitionname&gt;</span>com.woltlab.wcf.multifactor<span class="nt">&lt;/definitionname&gt;</span>
2232     <span class="nt">&lt;icon&gt;</span><span class="c">&lt;!-- Font Awesome 4 Icon Name goes here. --&gt;</span><span class="nt">&lt;/icon&gt;</span>
2233     <span class="nt">&lt;priority&gt;</span><span class="c">&lt;!-- Determines the sort order, higher priority will be preferred for authentication. --&gt;</span><span class="nt">&lt;/priority&gt;</span>
2234     <span class="nt">&lt;classname&gt;</span>wcf\system\user\multifactor\FoobarMultifactorMethod<span class="nt">&lt;/classname&gt;</span>
2235 <span class="nt">&lt;/type&gt;</span>
2236 </code></pre></div>
2237 <p>The given classname must implement the <a href="https://github.com/WoltLab/WCF/blob/master/wcfsetup/install/files/lib/system/user/multifactor/IMultifactorMethod.class.php"><code>IMultifactorMethod</code></a> interface.</p>
2238 <p>As a self-contained example, you can find the initial implementation of the email multi-factor method in <a href="https://github.com/WoltLab/WCF/pull/3729">WoltLab/WCF#3729</a>.
2239 Please check <a href="https://github.com/WoltLab/WCF/commits/master/wcfsetup/install/files/lib/system/user/multifactor/EmailMultifactorMethod.class.php">the version history</a> of the PHP class to make sure you do not miss important changes that were added later.</p>
2240 <div class="admonition warning">
2241 <p class="admonition-title">Multi-factor authentication is security sensitive. Make sure to carefully read the remarks in <code>IMultifactorMethod</code> for possible issues. Also make sure to carefully test your implementation against all sorts of incorrect input and consider attack vectors such as race conditions. It is strongly recommended to generously check the current state by leveraging assertions and exceptions.</p>
2242 </div>
2243 <h2 id="deprecations-and-removals">Deprecations and Removals<a class="headerlink" href="#deprecations-and-removals" title="Permanent link">#</a></h2>
2244 <h3 id="sessionhandler">SessionHandler<a class="headerlink" href="#sessionhandler" title="Permanent link">#</a></h3>
2245 <p>Most of the changes with regard to the new session handling happened in <code>SessionHandler</code>.
2246 Most notably, <code>SessionHandler</code> now is marked <code>final</code> to ensure proper encapsulation of data.</p>
2247 <p>A number of methods in <code>SessionHandler</code> are now deprecated and result in a noop.
2248 This change mostly affects methods that have been used to bootstrap the session, such as <code>setHasValidCookie()</code>.</p>
2249 <p>Additionally, accessing the following keys on the session is deprecated.
2250 They directly map to an existing method in another class and any uses can easily be updated:
2251 - <code>ipAddress</code>
2252 - <code>userAgent</code>
2253 - <code>requestURI</code>
2254 - <code>requestMethod</code>
2255 - <code>lastActivityTime</code></p>
2256 <p>Refer to <a href="https://github.com/WoltLab/WCF/blob/439de4963c947c3569a0c584f795245f693155b0/wcfsetup/install/files/lib/system/session/SessionHandler.class.php#L168-L178">the implementation</a> for details.</p>
2257 <h3 id="acp-sessions">ACP Sessions<a class="headerlink" href="#acp-sessions" title="Permanent link">#</a></h3>
2258 <p>The database tables related to ACP sessions have been removed.
2259 The PHP classes have been preserved due to being used within the class hierarchy of the legacy sessions.</p>
2260 <h3 id="cookies">Cookies<a class="headerlink" href="#cookies" title="Permanent link">#</a></h3>
2261 <p>The <code>_userID</code>, <code>_password</code>, <code>_cookieHash</code> and <code>_cookieHash_acp</code> cookies will no longer be created nor consumed.</p>
2262 <h3 id="virtual-sessions">Virtual Sessions<a class="headerlink" href="#virtual-sessions" title="Permanent link">#</a></h3>
2263 <p>The virtual session logic existed to support multiple devices per single session in <code>wcf1_session</code>.
2264 Virtual sessions are no longer required with the refactored session handling.</p>
2265 <p>Anything related to virtual sessions has been completely removed as they are considered an implementation detail.
2266 This removal includes PHP classes and database tables.</p>
2267 <h3 id="security-token-constants">Security Token Constants<a class="headerlink" href="#security-token-constants" title="Permanent link">#</a></h3>
2268 <p>The security token constants are deprecated.
2269 Instead, the methods of <code>SessionHandler</code> should be used (e.g. <code>-&gt;getSecurityToken()</code>).
2270 Within templates, you should migrate to the <code>{csrfToken}</code> tag in place of <code>{@SECURITY_TOKEN_INPUT_TAG}</code>.
2271 The <code>{csrfToken}</code> tag is a drop-in replacement and was backported to WoltLab Suite 5.2+, allowing you to maintain compatibility across a broad range of versions.</p>
2272 <h3 id="passwordutil-and-double-bcrypt-hashes">PasswordUtil and Double BCrypt Hashes<a class="headerlink" href="#passwordutil-and-double-bcrypt-hashes" title="Permanent link">#</a></h3>
2273 <p>Most of the methods in PasswordUtil are deprecated in favor of the new password hashing framework.</p>
2274
2275
2276
2277
2278 <hr>
2279 <div class="md-source-date">
2280   <small>
2281
2282       Last update: 2021-02-11
2283
2284   </small>
2285 </div>
2286
2287
2288
2289
2290
2291
2292
2293
2294             </article>
2295           </div>
2296         </div>
2297       </main>
2298
2299
2300 <footer class="md-footer">
2301
2302     <nav class="md-footer__inner md-grid" aria-label="Footer">
2303
2304         <a href="../php/" class="md-footer__link md-footer__link--prev" rel="prev">
2305           <div class="md-footer__button md-icon">
2306             <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11h12z"/></svg>
2307           </div>
2308           <div class="md-footer__title">
2309             <div class="md-ellipsis">
2310               <span class="md-footer__direction">
2311                 Previous
2312               </span>
2313               PHP API
2314             </div>
2315           </div>
2316         </a>
2317
2318
2319         <a href="../javascript/" class="md-footer__link md-footer__link--next" rel="next">
2320           <div class="md-footer__title">
2321             <div class="md-ellipsis">
2322               <span class="md-footer__direction">
2323                 Next
2324               </span>
2325               JavaScript
2326             </div>
2327           </div>
2328           <div class="md-footer__button md-icon">
2329             <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M4 11v2h12l-5.5 5.5 1.42 1.42L19.84 12l-7.92-7.92L10.5 5.5 16 11H4z"/></svg>
2330           </div>
2331         </a>
2332
2333     </nav>
2334
2335   <div class="md-footer-meta md-typeset">
2336     <div class="md-footer-meta__inner md-grid">
2337       <div class="md-footer-copyright">
2338
2339           <div class="md-footer-copyright__highlight">
2340             Copyright © 2020 WoltLab GmbH
2341           </div>
2342
2343         Made with
2344         <a href="https://squidfunk.github.io/mkdocs-material/" target="_blank" rel="noopener">
2345           Material for MkDocs
2346         </a>
2347
2348       </div>
2349       <div class="md-footer-copyright">
2350         <a href="https://www.woltlab.com/legal-notice/">Legal Notice</a>
2351         <a href="https://www.woltlab.com/privacy-policy/">Privacy Policy</a>
2352 </div>
2353     </div>
2354   </div>
2355 </footer>
2356
2357     </div>
2358     <div class="md-dialog" data-md-component="dialog">
2359       <div class="md-dialog__inner md-typeset"></div>
2360     </div>
2361     <script id="__config" type="application/json">{"base": "../../..", "features": [], "translations": {"clipboard.copy": "Copy to clipboard", "clipboard.copied": "Copied to clipboard", "search.config.lang": "en", "search.config.pipeline": "trimmer, stopWordFilter", "search.config.separator": "[\\s\\-]+", "search.placeholder": "Search", "search.result.placeholder": "Type to start searching", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.term.missing": "Missing"}, "search": "../../../assets/javascripts/workers/search.fb4a9340.min.js", "version": {"provider": "mike"}}</script>
2362
2363
2364       <script src="../../../assets/javascripts/bundle.5cf3e710.min.js"></script>
2365
2366
2367   </body>
2368 </html>