MfaSessionManager
class MfaSessionManager (View source)
Sets, reads and resets the MFA pending/verified state in the session.
Methods
Flags a user as requiring MFA verification
Marks MFA as completed and sets the user as fully authenticated
Check if MFA is required for the current user
The session's verification state.
Record that no second factor applies, so the four slots cannot disagree.
Reset all MFA-related session variables
Details
__construct(SessionInterface $session, LoggerInterface|null $logger = null)
No description
void
setMfaRequired(int $userId)
Flags a user as requiring MFA verification
void
setMfaVerified()
Marks MFA as completed and sets the user as fully authenticated
bool
isMfaRequired()
Check if MFA is required for the current user
MfaSessionState
currentState()
The session's verification state.
Sessions established before MFA_STATE existed are classified from the legacy slots, which is why that reconciliation is still here. Its "absent means not required" default is load-bearing: users who have no second factor never get any of these keys set.
void
setMfaNotRequired()
Record that no second factor applies, so the four slots cannot disagree.
void
reset()
Reset all MFA-related session variables