System\Twig\SecurityPolicy\SafeSessionStore

Overview

SafeSessionStore is a session proxy class that is safe for use in Twig.

It exposes a stable, explicit subset of read/write methods to theme templates and rejects writes to session keys reserved by the framework for authentication, CSRF, and other internal state.

Implements

• October\Contracts\Twig\CallsAnyMethod

Protected Properties

protected Illuminate\Session\Store $session

session instance being proxied

protected array $allowedMethods

allowedMethods is the explicit Twig surface of the session. Anything not in this list is blocked, including session lifecycle methods (start, save, invalidate, regenerate, migrate, setId, setHandler, replace).

protected array $writeMethods

writeMethods take a key as their first argument and must have that key validated against $reservedKeyPrefixes.

protected array $reservedKeyPrefixes

reservedKeyPrefixes that themes cannot write to or forget. Reserved for authentication, CSRF, and Laravel framework internals.

Public Methods

public __call()

public __call($method, $parameters): void

__call magic

public __construct()

public __construct($session): void

Protected Methods

protected assertKeyAllowed()

protected assertKeyAllowed($method, $key): void 

assertKeyAllowed rejects writes to reserved session key prefixes. Arrays (e.g. put(['k' => 'v'], ...)) and dot-notation keys are normalized to their top-level segment before checking.