You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Getting rid of the unnecessary dependencies is a good idea. I think we can remove yiisoft/cookies, along with CookieLogin, CookieLoginIdentityInterface and CookieLoginMiddleware, and put them in a separate package called yiisoft/cookie-login.
The new package, yiisoft/cookie-login, will depend on the yiisoft/user and yiisoft/cookies packages.
This will reduce the dependencies for the yiisoft/user package.
Getting rid of the unnecessary dependencies is a good idea. I think we can remove yiisoft/cookies, along with CookieLogin, CookieLoginIdentityInterface and CookieLoginMiddleware, and put them in a separate package called yiisoft/cookie-login.
The new package, yiisoft/cookie-login, will depend on the yiisoft/user and yiisoft/cookies packages.
This will reduce the dependencies for the yiisoft/user package.
We can leave CookieLogin, CookieLoginIdentityInterface and CookieLoginMiddleware in yiisoft/user, just implement it without yiisoft/cookies usage.
If we implement these classes without using the yiisoft/cookies package, we will end up writing new code to achieve the same result, rather than making use of existing code within the package.
The yiisoft/session package also uses "a tiny part" of the yiisoft/cookies package. If so, should we remove the yiisoft/cookies package from the yiisoft/session package too?
The package uses only a tiny part of yiisoft/cookies — building a single Set-Cookie header in CookieLogin. It would be nice to drop it.
I used the yiisoft/session package as an example of one that also uses "a tiny part" of the yiisoft/cookies package.
What criterion should we use to decide whether a part is "tiny" enough to justify removing the yiisoft/cookies package?
These arguments are valid.
However, even if the yiisoft/cookies dependency were removed from yiisoft/user, an app using the yiisoft/user package would still have the yiisoft/cookies dependency, as yiisoft/user depends on yiisoft/session, which depends on yiisoft/cookies.
So what would be the point of removing the yiisoft/cookies dependency from yiisoft/user?
In my opinion, it would make sense to remove the yiisoft/cookies dependency from yiisoft/session, as this would not affect the other code.
However, it would be unwise to remove the yiisoft/cookies dependency from yiisoft/user, since having two incompatible cookie protection methods within the same framework would cause problems.
two incompatible cookie protection methods within the same framework would cause problem
Why "incompatible"? This is compatible, even if the user uses both the middleware from yiisoft/cookies and the built‑in protection by yiisoft/user, everything will work. Right?
Why "incompatible"? This is compatible, even if the user uses both the middleware from yiisoft/cookies and the built‑in protection by yiisoft/user, everything will work. Right?
This is an independent functionality. CookieSigner and CookieLogin doesn't affect each other.
Yes, they don't affect each other directly, but rather via cookies. For example, you could use CookieLogin for a signed cookie, and then use Yiisoft\Cookies\CookieMiddleware plus MyCookieLoginMiddleware instead of CookieLoginMiddleware for an unsigned one.
This is an independent functionality. CookieSigner and CookieLogin doesn't affect each other.
Yes, they don't affect each other directly, but rather via cookies. For example, you could use CookieLogin for a signed cookie, and then use Yiisoft\Cookies\CookieMiddleware plus MyCookieLoginMiddleware instead of CookieLoginMiddleware for an unsigned one.
If you use CookieLogin into MyCookieLoginMiddleware, it will be work.
If you use CookieLogin into MyCookieLoginMiddleware, it will be work.
In the above example, I suppose that Yiisoft\Cookies\CookieMiddleware is responsible for unsigned cookies, which is why I mentioned incompatible cookie protection methods within the same framework.
In the above example, I suppose that Yiisoft\Cookies\CookieMiddleware is responsible for unsigned cookies, which is why I mentioned incompatible cookie protection methods within the same framework.
There should be no situation where CookieLogin encodes a cookie value and then it is not used for decoding. The presence of CookieMiddleware does not affect this.
request - CookieMiddleware (encode/decode) - CookieLogin — CookieMiddleware here always make own work before CookieLogin.
Are you planning to add the ability to encrypt cookie values, thus making the yiisoft/user package equivalent to the yiisoft/cookies dependencies that were removed in terms of cookie protection?
Activity
klsoft-web commentedon Sep 3, 2026
Getting rid of the unnecessary dependencies is a good idea. I think we can remove
yiisoft/cookies, along withCookieLogin,CookieLoginIdentityInterfaceandCookieLoginMiddleware, and put them in a separate package calledyiisoft/cookie-login.The new package,
yiisoft/cookie-login, will depend on theyiisoft/userandyiisoft/cookiespackages.This will reduce the dependencies for the yiisoft/user package.
vjik commentedon Sep 3, 2026
We can leave
CookieLogin,CookieLoginIdentityInterfaceandCookieLoginMiddlewareinyiisoft/user, just implement it withoutyiisoft/cookiesusage.klsoft-web commentedon Sep 3, 2026
If we implement these classes without using the
yiisoft/cookiespackage, we will end up writing new code to achieve the same result, rather than making use of existing code within the package.The
yiisoft/sessionpackage also uses "a tiny part" of theyiisoft/cookiespackage. If so, should we remove theyiisoft/cookiespackage from theyiisoft/sessionpackage too?vjik commentedon Sep 3, 2026
No. We use contract
SessionInterface, therefore, I would keep theyiisoft/sessiondependency.klsoft-web commentedon Sep 3, 2026
I used the
yiisoft/sessionpackage as an example of one that also uses "a tiny part" of theyiisoft/cookiespackage.What criterion should we use to decide whether a part is "tiny" enough to justify removing the
yiisoft/cookiespackage?samdark commentedon Sep 4, 2026
That is a very good question. It is a balance.
For dependency, it is all about code reuse:
Against dependency:
klsoft-web commentedon Sep 4, 2026
These arguments are valid.
However, even if the
yiisoft/cookiesdependency were removed fromyiisoft/user, an app using theyiisoft/userpackage would still have theyiisoft/cookiesdependency, asyiisoft/userdepends onyiisoft/session, which depends onyiisoft/cookies.So what would be the point of removing the
yiisoft/cookiesdependency fromyiisoft/user?samdark commentedon Sep 4, 2026
Yes, if there is such a cyclic dependency, then that's a no-go, it makes no sense.
samdark commentedon Sep 4, 2026
@vjik ?
vjik commentedon Sep 6, 2026
It can be fixed: yiisoft/session#86 . In sessions
yiisoft/cookiesdependency need even less.klsoft-web commentedon Sep 6, 2026
In my opinion, it would make sense to remove the
yiisoft/cookiesdependency fromyiisoft/session, as this would not affect the other code.However, it would be unwise to remove the
yiisoft/cookiesdependency fromyiisoft/user, since having two incompatible cookie protection methods within the same framework would cause problems.vjik commentedon Sep 6, 2026
Why "incompatible"? This is compatible, even if the user uses both the middleware from
yiisoft/cookiesand the built‑in protection byyiisoft/user, everything will work. Right?klsoft-web commentedon Sep 7, 2026
It's because CookieSigner uses the MD5 value for signing, unlike CookieLogin.
vjik commentedon Sep 7, 2026
This is an independent functionality.
CookieSignerandCookieLogindoesn't affect each other.klsoft-web commentedon Sep 7, 2026
Yes, they don't affect each other directly, but rather via cookies. For example, you could use
CookieLoginfor a signed cookie, and then useYiisoft\Cookies\CookieMiddlewareplusMyCookieLoginMiddlewareinstead ofCookieLoginMiddlewarefor an unsigned one.vjik commentedon Sep 7, 2026
If you use
CookieLoginintoMyCookieLoginMiddleware, it will be work.klsoft-web commentedon Sep 7, 2026
In the above example, I suppose that
Yiisoft\Cookies\CookieMiddlewareis responsible for unsigned cookies, which is why I mentioned incompatible cookie protection methods within the same framework.vjik commentedon Sep 7, 2026
There should be no situation where
CookieLoginencodes a cookie value and then it is not used for decoding. The presence ofCookieMiddlewaredoes not affect this.request - CookieMiddleware (encode/decode) - CookieLogin—CookieMiddlewarehere always make own work beforeCookieLogin.klsoft-web commentedon Sep 7, 2026
Are you planning to add the ability to encrypt cookie values, thus making the
yiisoft/userpackage equivalent to theyiisoft/cookiesdependencies that were removed in terms of cookie protection?