<p dir="auto">I am not 100% sure if this is a symfony bug because I am using FoSUserBundle, but from my debugging it seems to be a symfony error.</p>
<p dir="auto">The Symfony Session caller saves two sessions on authentication. One of them is a blank session with an array that looks like an empty _sf2_attributes array, and the other is the actual session. The PHPSESSID cookie is then changed to the new, different session id.</p>
<p dir="auto">Technically, everything works. I am able to authenticate my users. but my redis cache is double the size it needs to be and Im starting to get short on memory. I want to get rid of these duplicate keys.</p>
<p dir="auto">I have also tried memcached and file storage ontop of sncRedisBundle. They both also produce double sessions when authenticated. So I do believe it is a symfony issue.</p>
<p dir="auto">You can see this in the logs by watching for the REDIS commands being logged by SncRedisBundle (the memcache and file storage do not have debug logs)<br>
Here is some examples</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="INFO - Matched route &quot;fos_user_security_check&quot; (parameters: &quot;_controller&quot;: &quot;FOS\UserBundle\Controller\SecurityController::checkAction&quot;, &quot;_route&quot;: &quot;fos_user_security_check&quot;)
INFO - Executing command &quot;SETNX SESSIONagj232vmqo5ngavqvha016lv1oh00oqe7g22q2eta9skv0lftqr1.lock 1&quot;
INFO - Executing command &quot;EXPIRE SESSIONagj232vmqo5ngavqvha016lv1oh00oqe7g22q2eta9skv0lftqr1.lock 61&quot;
INFO - Executing command &quot;GET SESSION:agj232vmqo5ngavqvha016lv1oh00oqe7g22q2eta9skv0lftqr1&quot;
INFO - User &quot;Austin&quot; has been authenticated successfully
INFO - Executing command &quot;SETEX SESSION:lu735ketuop9dgfh3qitmujge6491274vadfdsdfafadBLAH BLAH SERIALIZED TOKEN CODE HERE;}}i:3;a:0:{}}&quot;;}}
INFO - Executing command &quot;DEL SESSIONagj232vmqo5ngavqvha016lv1oqe7g22q2eta9skv0lftqr1.lock&quot; "><pre class="notranslate"><code class="notranslate">INFO - Matched route "fos_user_security_check" (parameters: "_controller": "FOS\UserBundle\Controller\SecurityController::checkAction", "_route": "fos_user_security_check")
INFO - Executing command "SETNX SESSIONagj232vmqo5ngavqvha016lv1oh00oqe7g22q2eta9skv0lftqr1.lock 1"
INFO - Executing command "EXPIRE SESSIONagj232vmqo5ngavqvha016lv1oh00oqe7g22q2eta9skv0lftqr1.lock 61"
INFO - Executing command "GET SESSION:agj232vmqo5ngavqvha016lv1oh00oqe7g22q2eta9skv0lftqr1"
INFO - User "Austin" has been authenticated successfully
INFO - Executing command "SETEX SESSION:lu735ketuop9dgfh3qitmujge6491274vadfdsdfafadBLAH BLAH SERIALIZED TOKEN CODE HERE;}}i:3;a:0:{}}";}}
INFO - Executing command "DEL SESSIONagj232vmqo5ngavqvha016lv1oqe7g22q2eta9skv0lftqr1.lock" 
</code></pre></div>
<p dir="auto">As you can see there are two keys being authenticated here:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="lu735ketuop9dgfh3qitmujge6491274vadfdsdfafad
VS agj232vmqo5ngavqvha016lv1oh00oqe7g22q2eta9skv0lftqr"><pre class="notranslate"><code class="notranslate">lu735ketuop9dgfh3qitmujge6491274vadfdsdfafad
VS agj232vmqo5ngavqvha016lv1oh00oqe7g22q2eta9skv0lftqr
</code></pre></div>
<p dir="auto">I can also show you two session files that have the same thing when using the default session File Handler</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="sess_bcf61a9jhticgmlec8q32i3vp8hculhojt8e15p20fte8k1  sess_tbtp0p5dsfdl6hu6pelkpr64vlq1sjrlpg4nsuq2fc2l00"><pre class="notranslate"><code class="notranslate">sess_bcf61a9jhticgmlec8q32i3vp8hculhojt8e15p20fte8k1  sess_tbtp0p5dsfdl6hu6pelkpr64vlq1sjrlpg4nsuq2fc2l00
</code></pre></div>
<p dir="auto">Two session files. First one contains empty sf_attributes{} and the second the logged in session.</p>
<p dir="auto">Something changes after "DEBUG - Write SecurityContext in the session " call. That's how far I have narrowed it down (so...not much)</p>
<p dir="auto">Anyway this can get fixed? or maybe it's something on my end? I'm not so great with Framework internals, so maybe someone can help me out.</p>
<table role="table">
<thead>
<tr>
<th>Q</th>
<th>A</th>
</tr>
</thead>
<tbody>
<tr>
<td>Bug report?</td>
<td>no</td>
</tr>
<tr>
<td>Feature request?</td>
<td>yes</td>
</tr>
<tr>
<td>BC Break report?</td>
<td>no</td>
</tr>
<tr>
<td>RFC?</td>
<td>yes</td>
</tr>
<tr>
<td>Symfony version</td>
<td>latest</td>
</tr>
</tbody>
</table>
<p dir="auto">If you have an entity with a state machine attached, you can still just set any state as current and save if you're not using <code class="notranslate">apply()</code>.</p>
<p dir="auto">It would make sense to add a validator specifically enforcing the attached state machine, it would:</p>
<ol dir="auto">
<li>figure out if the state being set is actually a valid state at all</li>
<li>figure out if the state being set is a valid state <strong>from current state</strong></li>
<li>(this is debateable) try to apply the state so event listeners are able to block the transition?</li>
</ol>
<p dir="auto">It would allow for more easier integration of the component into common workflows, IMO.</p>
<p dir="auto"><strong>Edit:</strong> if 3) is considered, listeners should probably be able to provide an explanation why they've blocked the transition (<code class="notranslate">ConstraintViolationInterface</code> or similar?)</p>
<p dir="auto">WDYT?</p>