ManageSessionMiddleware runs even with Stateless attr

[laylatichy]

Tempest version

3.6

PHP version

8.5

Operating system

macOS

Description

ManageSessionMiddleware is currently running on stateless routes

ManageSessionMiddleware has #[Priority(Priority::FRAMEWORK - 20)]

Running before MatchRouteMiddleware #[Priority(Priority::FRAMEWORK - 9)]

in result ignoring stateless

[brendt]

@innocenzi I was working on this one, but since you're now also working on sessions, I was wondering if you had an opinion on the matter?

The problem I run into is that moving the MatchRoute middleware up front breaks some session-related validation logic. I haven't looked deeply into it.

Of course, the simplest solution would be to keep to priority as is right now, and have a manual check on MatchedRoute when the session middleware runs (by injecting the container and only resolving MatchedRoute at runtime). We could check there if it has the stateless attribute, and not do anything if so. It's a dirty fix though, and it made me wonder: do you remember why the session middleware has to run with a lower priority as the match route middleware?

[innocenzi]

@brendt I don't remember the reason, have you tried changing it and see if that breaks tests?

That's one reason why, when we designed the priority system, I suggested having the ability to specifically register middleware to be after or before another specific middleware

[brendt]

It's the order changing that breaks it yeah. Anyway I'll do some more debugging, no worries :)