echo-fusion / sessionmanager

v1.0.2 2026-10-12 12:23 UTC

Requires

• php: ~8.1.0 || ~8.2.0 || ~8.3.0
• echo-fusion/contracts: ^1.4 || ^2.0
• psr/http-message: ^2.0
• psr/http-server-handler: ^1.0
• psr/http-server-middleware: ^1.0

Requires (Dev)

• echo-fusion/codestandard: ^1.0
• friendsofphp/php-cs-fixer: ^3.64
• guzzlehttp/psr7: ^2.5
• phpunit/phpunit: ^9.5
• vimeo/psalm: ^5.26

MIT

• Amir Shadanfar

• session
• psr-15
• echoFusion

Published on Packagist.org on 2026-10-12 12:23 UTC

README

SessionManager provides session handling for the EchoFusion framework: a session backed by PHP's native sessions, an in-memory session for tests and CLI code, flash messages, and a PSR-15 middleware that starts the session.

Both sessions implement EchoFusion\Contracts\SessionManager\SessionInterface from echo-fusion/contracts, so other packages can depend on the interface only.

Part of EchoFusion, a modular PHP framework built from small packages.

Installation

composer require echo-fusion/sessionmanager

Requirements

• PHP 8.1, 8.2 or 8.3

Usage

Native session

use EchoFusion\SessionManager\NativeSession;
use EchoFusion\SessionManager\SessionOptions;

$session = new NativeSession(new SessionOptions(name: 'app_sid', lifetime: 7200));
$session->start();

$session->put('user', 42);
$session->get('user');            // 42
$session->get('missing', 'n/a');  // 'n/a'
$session->has('user');            // true
$session->forget('user');

$session->regenerate();           // new session id, e.g. after login or logout
$session->save();                 // write and close

SessionOptions defaults are secure: the cookie is Secure, HttpOnly and SameSite=Lax. For local development over plain HTTP pass secure: false.

Calling get, put, has, forget, regenerate, flash or getFlash before start() throws EchoFusion\SessionManager\Exceptions\SessionException, as does starting a session twice or after output has been sent.

Flash messages

$session->flash('errors', ['Email is required']);

// on the next request
$session->getFlash('errors');  // ['Email is required']
$session->getFlash('errors');  // []  (read once)

Flash data is stored under an internal key, so it never collides with your own keys.

In-memory session

ArraySession has the same behaviour without touching $_SESSION, which makes it handy in tests:

use EchoFusion\SessionManager\ArraySession;

$session = new ArraySession();
$session->start();

Middleware

StartSessionMiddleware is a PSR-15 middleware that starts the session (if it is not already active) before the rest of the pipeline runs:

use EchoFusion\SessionManager\Middleware\StartSessionMiddleware;

$middleware = new StartSessionMiddleware($session);

Testing

composer test

Credits

• Amir Shadanfar

License

The MIT License (MIT). Please see LICENSE for more information.