Symfony News

New in Symfony 5.3: Session Service Deprecation

Contributed by
Jérémy Derussé
in #38616.

In Symfony applications you can access the session via the session service or its SessionInterface autowiring alias. This is convenient, but it’s technically wrong for some reasons:

• Session is a data object (e.g. like the Request object) so there shouldn’t be a service defined for it in the container;
• Sessions are not part of the HTTP specification (either HTTP/1.1, HTTP/2 or HTTP/3) because HTTP is stateless. That’s why it feels odd to handle sessions as part of the HttpFoundation component.

That’s why, many years after it was first proposed, we’re deprecating the session service in Symfony 5.3 and we’ll remove it in Symfony 6.0. Instead of injecting that session service you now have to inject the RequestStack service and use the new getSession() method:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

use Symfony\Component\HttpFoundation\RequestStack;

class SomeService
{
    private $requestStack;

    public function __construct(RequestStack $requestStack)
    {
        $this->requestStack = $requestStack;
    }

    public function someMethod()
    {
        $session = $this->requestStack->getSession();
        // ... do something with the session
    }

    // ...
}