public function isValidSession($authCookie)
    {
        if ($authCookie === null) {
            throw new AccessControlException('Can not validate session with an empty token.');
        }

        if ($this->validSession !== null) {
            return $this->validSession;
        }

        $check = false;
        $sessionAuth = null;

        /** @var \Bolt\AccessControl\Token\Token $sessionAuth */
        if ($this->session->isStarted() && $sessionAuth = $this->session->get('authentication')) {
            $check = $this->checkSessionStored($sessionAuth);
        }

        if (!$check) {
            // Either the session keys don't match, or the session is too old
            $check = $this->checkSessionDatabase($authCookie);
        }

        if ($check) {
            return $this->validSession = true;
        }
        $this->validSession = false;
        $this->systemLogger->debug("Clearing sessions for expired or invalid token: $authCookie", ['event' => 'authentication']);

        return $this->revokeSession();
    }
public function isValidSession($authCookie)
    {
        if ($authCookie === null) {
            throw new AccessControlException('Can not validate session with an empty token.');
        }

        if ($this->validSession !== null) {
            return $this->validSession;
        }

        $check = false;
        $sessionAuth = null;

        /** @var \Bolt\AccessControl\Token\Token $sessionAuth */
        if ($this->session->isStarted() && $sessionAuth = $this->session->get('authentication')) {
            $check = $this->checkSessionStored($sessionAuth);
        }

        if (!$check) {
            // Either the session keys don't match, or the session is too old
            $check = $this->checkSessionDatabase($authCookie);
        }

        if ($check) {
            return $this->validSession = true;
        }
        $this->validSession = false;
        $this->systemLogger->debug("Clearing sessions for expired or invalid token: $authCookie", ['event' => 'authentication']);

        return $this->revokeSession();
    }
public function isValidSession ( $ authCookie ) { if ( $ authCookie === null ) { throw new AccessControlException ( 'Can not validate session with an empty token.' ) ; } if ( $ this -> validSession !== null ) { return $ this -> validSession ; } $ check = false ; $ sessionAuth = null ; /** @var \Bolt\AccessControl\Token\Token $sessionAuth */ if ( $ this -> session -> isStarted ( ) && $ sessionAuth = $ this -> session -> get ( 'authentication' ) ) { $ check = $ this -> checkSessionStored ( $ sessionAuth ) ; } if ( ! $ check ) { // Either the session keys don't match, or the session is too old $ check = $ this -> checkSessionDatabase ( $ authCookie ) ; } if ( $ check ) { return $ this -> validSession = true ; } $ this -> validSession = false ; $ this -> systemLogger -> debug ( "Clearing sessions for expired or invalid token: $authCookie" , [ 'event' => 'authentication' ] ) ; return $ this -> revokeSession ( ) ; }
We will not allow tampering with sessions, so we make sure the current
session is still valid for the device on which it was created, and that
the username, and IP address, are still the same.

1. If user has a valid session and it is fresh, check against cookie:
- If NOT a match refuse
- If a match accept
2. If user has a valid session and it is stale (>10 minutes), check the
database records again:
- If disabled refuse
- If enabled
- If NOT a match refuse
- If a match accept
- Update session data
3. If user has no session check authtoken table entry (closed broswer):
- If passed validity date refuse
- If within validity date, hash username and IP against salt and
compare to database:
- If NOT a match refuse
- If a match accept

@param string $authCookie

@throws AccessControlException

@return bool
We will not allow tampering with sessions so we make sure the current session is still valid for the device on which it was created and that the username and IP address are still the same .