TYPO3 v15 dev-main snapshot ()

2026-08-10 22:31:09 +02:00
commit af8cc155b5
6818 changed files with 642608 additions and 0 deletions
@@ -0,0 +1,59 @@
+.. include:: /Includes.rst.txt
+
+.. _breaking-79513:
+
+=============================================================
+Breaking: #79513 - Removed session locking based on useragent
+=============================================================
+
+See :issue:`79513`
+
+Description
+===========
+
+When using session data or user-login functionality with TYPO3, the default configuration was to
+harden the session binding to the User Agent information sent by the HTTP request. If the user agent
+information does not match, the session gets renewed and the user gets logged out.
+
+The options :php:`$GLOBALS['TYPO3_CONF_VARS']['FE']['lockHashKeyWords']` and :php:`$GLOBALS['TYPO3_CONF_VARS']['BE']['lockHashKeyWords']`
+were set to "useragent" by default to use this additional session locking check.
+
+This case is especially problematic when having a larger website (e.g. a community platform) with
+100K frontend users and the session lifetime set to 6 months. After every security update of the
+browser or possibly a plugin, or if a version update is happening on Evergreen Browsers, then
+all users would get logged out, which is inconvenient.
+
+Based on the additional security level on top versus the user experience on the site, the "useragent"
+functionality has been dropped. Since the "lockHashKeyWords" options did only work on "useragent"
+and no other functionality was integrated, the option (and related, the database fields "ses_hashlock"
+as well) has been removed without substitution.
+
+
+Impact
+======
+
+The options :php:`$GLOBALS['TYPO3_CONF_VARS']['FE']['lockHashKeyWords']` and :php:`$GLOBALS['TYPO3_CONF_VARS']['BE']['lockHashKeyWords']`
+are removed automatically when hitting the install tool.
+
+The database fields 'fe_sessions.ses_hashlock' and 'be_sessions.ses_hashlock' have been removed.
+
+The public property :php:`$lockHashKeyWords` of the PHP class `AbstractUserAuthentication` has been
+removed and will throw a PHP Notice when trying to access it.
+
+All other functionality related to sessions still works the same.
+
+
+Affected Installations
+======================
+
+Any installation using the configuration options for custom checks based on the session handling
+with third-party extensions, which is very unlikely.
+
+
+Migration
+=========
+
+The TYPO3 Install Tool removes the configuration option for existing installations. Using the
+"Database Comparison" view, it is possible to remove the fields from the database.
+
+.. index:: LocalConfiguration, PHP-API