[mjansenDatabay]

…dateTimestampHandlerInterface`

Session ids are now rotated only at the points where the authenticated account changes.

• Login, logout, and expiry each get their own transition. onLoginSuccess() and onSessionExpired() rotate the id. logout() drops the previous $_SESSION payload, destroys the session, and starts a new anonymous one. ensureAnonymousContext() keeps the current id for the login page and clears the payload only when leaving a logged-in account.
• A cookie whose id PHP adopted but which has no usr_session row is replaced at bootstrap. A registered cookie session is resumed unchanged.
• doStandardAuthentication is no longer a safe POST command, so the login POST requires an rtoken (CSRF) after the ctrl-security artifact is rebuilt.
• WebDAV, account migration, ECS, the calendar remote-access handler, and the Web Access Checker use the new fully-authenticated and anonymous-context checks.
• ilSessionDBHandler implements SessionUpdateTimestampHandlerInterface. An unchanged session extends its idle deadline without rewriting the stored payload.

Improvement-Request: https://mantis.ilias.de/view.php?id=24216

[thojou]

Hey @mjansenDatabay,

Thanks for the PR.

As we already discussed the details via chat, I'll go ahead and merge this PR now.
I've reviewed and tested the changes – it looks good to me!

Kind regards,
@thojou