SessionGatePolicy
final class SessionGatePolicy (View source)
Pure rules for which requests a session gate (required MFA setup, user agreement) holds back while the user still has to complete it.
Constants
| private PREFERENCES_PATH |
|
Methods
The key-authenticated public APIs carry no session and are skipped. The internal API runs on the session, so in strict mode it is refused until the user complies, except the preference read every page makes, the gate pages included. Strict matching is on whole API path segments, so a web page such as /settings/api/logs is still redirected. Without strict mode every path containing /api/ is skipped, as before 4.6.0.
Details
static SessionGateAction
decide(string $path, array $gatePaths, string $method, bool $strict)
The key-authenticated public APIs carry no session and are skipped. The internal API runs on the session, so in strict mode it is refused until the user complies, except the preference read every page makes, the gate pages included. Strict matching is on whole API path segments, so a web page such as /settings/api/logs is still redirected. Without strict mode every path containing /api/ is skipped, as before 4.6.0.