feat: move Symfony sessions to Redis, env-configurable

framework.session.handler_id now reads from SESSION_HANDLER_DSN, which
defaults to the existing REDIS_CACHE_DSN so dev (and prod that has Redis
available) gets Redis-backed sessions out of the box. Operators can set
SESSION_HANDLER_DSN= (empty) to fall back to PHP's native file handler.

Why move:
- Removes the per-session flock that serialises parallel session-touching
  requests on the file handler (visible as inconsistent tail latency
  when the React admin fires concurrent fetches).
- Sessions survive container restarts without mounting /tmp as a volume.
- Multi-pod deployments share session state without sticky routing —
  the OIDC handshake works regardless of which pod handles the callback.

The new RedisSessionHandler is auto-built by Symfony from the DSN; it
prefixes keys with `sf_s` so they don't collide with cache keys on the
same Redis DB. when@test forces handler_id back to null, since
MockFileSessionStorage doesn't go through a handler and we don't want
the test container to compile a Redis handler against an env that may
not point at a reachable Redis.

Verified locally: HTTP request to /v2/authentication/oidc/urls writes a
`sf_s<id>` key into Redis; full PHPUnit suite (143 tests, 607
assertions) passes with redis DBSIZE=0 after, confirming the test
override works.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: turegjorup

.env

@@ -72,6 +72,13 @@ JWT_SCREEN_REFRESH_TOKEN_TTL=2592000
 REDIS_CACHE_PREFIX=DisplayApiService
 # Connection string for Redis cache server.
 REDIS_CACHE_DSN=redis://redis:6379/0
+# Session storage backend, consumed by framework.session.handler_id.
+# A `redis://...` DSN makes Symfony auto-build a RedisSessionHandler (with
+# its own `sf_s` key prefix, so cache and session keys don't collide on
+# the same DB). Empty value = PHP's native file handler; pick that for
+# single-pod deployments that don't care about flock-induced tail latency
+# or container-restart session survival.
+SESSION_HANDLER_DSN=${REDIS_CACHE_DSN}
 ###< redis ###
 
 ###> Http Client ###

CHANGELOG.md

@@ -10,6 +10,10 @@ All notable changes to this project will be documented in this file.
 - Aligned API and Nginx image labels with the OCI image spec: dropped deprecated `LABEL maintainer`,
   added `org.opencontainers.image.{authors,vendor,documentation,base.name}`, and fixed the Nginx image's
   `title`/`description` so it stops inheriting the source-repo defaults.
+- Switched Symfony session storage to Redis (default `SESSION_HANDLER_DSN=${REDIS_CACHE_DSN}`); set
+  `SESSION_HANDLER_DSN=` empty to fall back to PHP's native file handler. Removes the per-session
+  `flock` that serialised parallel session-touching requests and lets sessions survive container
+  restarts; multi-pod deployments now share session state without sticky routing.
 
 ## [3.0.0-rc2] - 2026-05-05
 

config/packages/framework.yaml

@@ -9,7 +9,13 @@ framework:
     # Enables session support. Note that the session will ONLY be started if you read or write from it.
     # Remove or comment this section to explicitly disable session support.
     session:
-        handler_id: null
+        # Empty falls back to PHP's native file handler; a `redis://...` DSN
+        # makes Symfony auto-build a RedisSessionHandler. See SESSION_HANDLER_DSN
+        # in .env. Redis-backed sessions remove the per-session flock that
+        # serialises parallel requests on the file handler and survive
+        # container restarts; local dev gets the same behaviour because the
+        # default DSN points at the compose Redis.
+        handler_id: '%env(SESSION_HANDLER_DSN)%'
         cookie_secure: auto
         cookie_samesite: lax
         storage_factory_id: session.storage.factory.native
@@ -33,4 +39,8 @@ when@test:
     framework:
         test: true
         session:
+            # MockFileSessionStorage keeps tests off Redis; force handler_id
+            # back to native so the Redis handler service isn't compiled
+            # against an env that may not point at a reachable Redis.
+            handler_id: null
             storage_factory_id: session.storage.factory.mock_file