PHPackages                             ujjwal/psr7-http-session - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [HTTP & Networking](/categories/http)
4. /
5. ujjwal/psr7-http-session

ActiveLibrary[HTTP & Networking](/categories/http)

ujjwal/psr7-http-session
========================

Alternative to PHP's native session handler for PSR-7

1.0.0(9y ago)782[1 PRs](https://github.com/ojhaujjwal/psr7-session/pulls)MITPHPPHP >=7.1

Since Aug 5Pushed 6y ago1 watchersCompare

[ Source](https://github.com/ojhaujjwal/psr7-session)[ Packagist](https://packagist.org/packages/ujjwal/psr7-http-session)[ RSS](/packages/ujjwal-psr7-http-session/feed)WikiDiscussions master Synced 2w ago

READMEChangelog (1)Dependencies (10)Versions (1)Used By (0)

PSR-7 Session
=============

[](#psr-7-session)

[![Build Status](https://camo.githubusercontent.com/d597da9aac264711778c2df578d8cb2e0ad85be4243b547e96ce56e1b55bf1ec/68747470733a2f2f7472617669732d63692e6f72672f6f6a6861756a6a77616c2f707372372d73657373696f6e2e7376673f6272616e63683d6d6173746572)](https://travis-ci.org/ojhaujjwal/psr7-session)[![Coverage Status](https://camo.githubusercontent.com/4d898425085fe7813b24c6cd3139139a8ed6bc0b9bea2e974c91b16720fb4326/68747470733a2f2f636f766572616c6c732e696f2f7265706f732f6769746875622f6f6a6861756a6a77616c2f707372372d73657373696f6e2f62616467652e7376673f6272616e63683d6d6173746572)](https://coveralls.io/github/ojhaujjwal/psr7-session?branch=master)[![Latest Stable Version](https://camo.githubusercontent.com/ae0a53c39a6cc7060a0ec1cce187b621882f96b1876e10ec6476d0cb6df6378d/68747470733a2f2f706f7365722e707567782e6f72672f756a6a77616c2f707372372d687474702d73657373696f6e2f762f737461626c65)](https://packagist.org/packages/ujjwal/psr7-http-session)[![Total Downloads](https://camo.githubusercontent.com/67a81cabe8ff5d72480182177dbfe4f6161629cab74ecdb648a7e1ab12f67184/68747470733a2f2f706f7365722e707567782e6f72672f756a6a77616c2f707372372d687474702d73657373696f6e2f646f776e6c6f616473)](https://packagist.org/packages/ujjwal/psr7-http-session)[![Latest Unstable Version](https://camo.githubusercontent.com/61554d26504b1dd67da33b65c14cf47617892270c945652dd19735ce7cca43a4/68747470733a2f2f706f7365722e707567782e6f72672f756a6a77616c2f707372372d687474702d73657373696f6e2f762f756e737461626c65)](https://packagist.org/packages/ujjwal/psr7-http-session)[![License](https://camo.githubusercontent.com/1af22b8f732e6d2a49cfe2fbd332eb7e5e84e316f3c5602eec2d320f66b9fdd2/68747470733a2f2f706f7365722e707567782e6f72672f756a6a77616c2f707372372d687474702d73657373696f6e2f6c6963656e7365)](https://packagist.org/packages/ujjwal/psr7-http-session)

Alternative to PHP's native session handler. It does not depend on PHP's session capability. It can be used with non-typical php based applications like with [react/http](https://github.com/reactphp/http).

### But, why?

[](#but-why)

[![But, why?](https://camo.githubusercontent.com/9a7dec8a2b7b660de0ee6b8a75487207e8879e0876160277a185ac8b23bd4888/687474703a2f2f7669676e65747465322e77696b69612e6e6f636f6f6b69652e6e65742f76616d70697265646961726965732f696d616765732f632f63612f4275742d7768792d6d656d652d67656e657261746f722d6275742d7768792d3834313033642e6a70672f7265766973696f6e2f6c61746573743f63623d3230313330383131313934383135253544)](https://camo.githubusercontent.com/9a7dec8a2b7b660de0ee6b8a75487207e8879e0876160277a185ac8b23bd4888/687474703a2f2f7669676e65747465322e77696b69612e6e6f636f6f6b69652e6e65742f76616d70697265646961726965732f696d616765732f632f63612f4275742d7768792d6d656d652d67656e657261746f722d6275742d7768792d3834313033642e6a70672f7265766973696f6e2f6c61746573743f63623d3230313330383131313934383135253544)

- You don't have to depend on `session_` functions which means you can write testable code.
- You don't have to depend on `$_SESSION` superglobal allowing you to write more testable code.
- You can even use this for non-typical php based applications like with [react/http](https://github.com/reactphp/http).
- You can create a framework agnostic library/module depending on [psr-7](http://www.php-fig.org/psr/psr-7/) HTTP message interfaces and this session library.

Getting started
---------------

[](#getting-started)

```
$sessionOptions = [
    'name' => 'session_id',
    'sid_length' => 40,
    'cookie' => [
        'domain' => 'your-app.com',
    ]
];

$sessionHandler = new Ojhaujjwal\Session\Handler\FileHandler('path/to/session-data');
$sessionManager = new Ojhaujjwal\Session\SessionManager(
    $sessionHandler,
    $request,
    $sessionOptions
);
$storage = $sessionManager->getStorage();

$sessionManager->start();

// you can manipulate $storage just like $_SESSION
$storage['some_key'] = 'some_value';
$someKey = $storage['some_key'];

$response = $sessionManager->close($response);
//return the response the the client
```

### Installation

[](#installation)

`composer require ujjwal/psr7-http-session`

### Session Options

[](#session-options)

##### name

[](#name)

Type: string Required: true

Name of the session which is used as cookie name. It should only contain alphanumeric characters.

#### sid\_length

[](#sid_length)

Type: integer Default: 40

the length of session ID string. Session ID length can be between 22 to 256.

#### cookie

[](#cookie)

Type: array

Used to pass cookie options. See cookie options section.

### Cookie Options

[](#cookie-options)

#### domain

[](#domain)

Type: string Default: derived from the `Host` header of request

domain to be set in the session cookie.

#### path

[](#path)

Type: string Default: `/`

path to be set in the session cookie.

#### http\_only

[](#http_only)

Type: boolean Default: `true`

Marks the cookie as accessible only through the HTTP protocol. This means that the cookie won't be accessible by scripting languages, such as JavaScript.

#### secure\_only

[](#secure_only)

Type: boolean Default: True if the original request is https

It indicates whether cookies should only be sent over secure connections.

#### lifetime

[](#lifetime)

Type: integer Default: `0` for session cookie

It specifies the lifetime of the cookie in seconds which is sent to the browser. The value 0 means "until the browser is closed." Defaults to 0

#### same\_site

[](#same_site)

Type: string Default: `Lax`Specifies `SameSite` cookie attribute. Very useful to mitigate CSRF by preventing the browser from sending this cookie along with cross-site requests. Allowed values:

- empty string for not setting the attribute
- `ParagonIE\Cookie\Cookie::SAME_SITE_RESTRICTION_LAX`(fairly strict)
- `ParagonIE\Cookie\Cookie::SAME_SITE_RESTRICTION_STRICT`(very strict)

### Basic operations

[](#basic-operations)

#### Initializing SessionManager

[](#initializing-sessionmanager)

```
$sessionManager = new Ojhaujjwal\Session\SessionManager(
    $sessionHandler,
    $request,
    $sessionOptions
);
```

#### Starting session

[](#starting-session)

```
$sessionManager->start();

$sessionManager->isStarted(); // returns true
```

#### Retrieve session id

[](#retrieve-session-id)

```
$sessionManager->getId(); //returns alphanumeric string
```

#### Regenerate session id

[](#regenerate-session-id)

```
$sessionManager->regenerate();

$sessionManager->regenerate(false); // does not destroy old session
```

#### Close session and write to response header as cookie

[](#close-session-and-write-to-response-header-as-cookie)

```
$response = $sessionManager->close($response);
```

#### Retrieving session storage

[](#retrieving-session-storage)

```
$storage = $sessionManager->getStorage();
```

It implements `IteratorAggregate`, `ArrayAccess`, `Countable`So, it will look very much like `$_SESSION`. Just replace the `$_SESSION` occurrences in your app with instance of the object.

#### Write to session

[](#write-to-session)

```
$storage->abcd = 'efgh';
//or
$storage['abcd'] = 'efgh';
//or
$storage->set('abcd', 'efgh');
```

#### Read from session

[](#read-from-session)

```
$abcd =  $storage->abc;
//or
$abcd = $storage['abcd'];
//or
$abcd = $storage->get('abcd');
```

#### Remove from session

[](#remove-from-session)

```
unset($storage->abc);
//or
unset($storage['abcd']);
//or
$storage->remove('abcd');
```

#### Flush session data

[](#flush-session-data)

```
$storage->flush();
```

### Session Middleware

[](#session-middleware)

It also comes with a http middleware which you can use to automatically initialize session and write cookie to response. The middleware is compatible with `http-interop/http-middleware` based single pass approach or express-like double pass approach.

```
 $middleware = new Ojhaujjwal\Session\SessionMiddleware($handler, $sessionOptions);
 $middleware->process($request, $delegate);
 // or
 $middleware($request, $response, $next);

 //using with zend-expressive
 //after errorhandler and before the routing middleware
 $app->pipe(\Ojhaujjwal\Session\SessionMiddleware::class);
```

### TODO

[](#todo)

- Fix build in php7.2
- Garbage collection
- Cookie Based session handler
- Encryption Session Handler

License
-------

[](#license)

[MIT](LICENSE)

###  Health Score

26

—

LowBetter than 40% of packages

Maintenance20

Infrequent updates — may be unmaintained

Popularity11

Limited adoption so far

Community9

Small or concentrated contributor base

Maturity56

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Unknown

Total

1

Last Release

3297d ago

### Community

Maintainers

![](https://avatars.githubusercontent.com/u/4995501?v=4)[Ujjwal Ojha](/maintainers/ojhaujjwal)[@ojhaujjwal](https://github.com/ojhaujjwal)

---

Top Contributors

[![ojhaujjwal](https://avatars.githubusercontent.com/u/4995501?v=4)](https://github.com/ojhaujjwal "ojhaujjwal (29 commits)")

---

Tags

http-middlewarehttp-sessionphp-middlewarephp-sessionspsr-7session-cookiesession-handlersession-managementsession-middlewarehttppsr-7psr7sessionhttp-session

###  Code Quality

TestsPHPUnit

### Embed Badge

![Health badge](/badges/ujjwal-psr7-http-session/health.svg)

```
[![Health](https://phpackages.com/badges/ujjwal-psr7-http-session/health.svg)](https://phpackages.com/packages/ujjwal-psr7-http-session)
```

###  Alternatives

[guzzlehttp/psr7

PSR-7 message implementation that also provides common utility methods

7.9k1.1B4.4k](/packages/guzzlehttp-psr7)[symfony/psr-http-message-bridge

PSR HTTP message bridge

1.3k329.9M1.1k](/packages/symfony-psr-http-message-bridge)[shopware/core

Shopware platform is the core for all Shopware ecommerce products.

595.8M668](/packages/shopware-core)[mezzio/mezzio

PSR-15 Middleware Microframework

3973.9M133](/packages/mezzio-mezzio)[mimmi20/browser-detector

Library to detect Browsers and Devices

49158.4k5](/packages/mimmi20-browser-detector)[sunrise/http-router

A powerful solution as the foundation of your project.

16852.3k12](/packages/sunrise-http-router)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)