feat: move Symfony sessions to Redis, env-configurable

.env

@@ -72,6 +72,13 @@ JWT_SCREEN_REFRESH_TOKEN_TTL=2592000
 REDIS_CACHE_PREFIX=DisplayApiService
 # Connection string for Redis cache server.
 REDIS_CACHE_DSN=redis://redis:6379/0
+# Session storage backend, consumed by framework.session.handler_id.
+# A `redis://...` DSN makes Symfony auto-build a RedisSessionHandler (with
+# its own `sf_s` key prefix, so cache and session keys don't collide on
+# the same DB). Empty value = PHP's native file handler; pick that for
+# single-pod deployments that don't care about flock-induced tail latency
+# or container-restart session survival.
+SESSION_HANDLER_DSN=${REDIS_CACHE_DSN}
 ###< redis ###
 
 ###> Http Client ###

CHANGELOG.md

@@ -12,6 +12,10 @@ All notable changes to this project will be documented in this file.
   `title`/`description` so it stops inheriting the source-repo defaults.
 - Bumped the local dev Redis image from `redis:6` to `redis:8`. Production deployments are unaffected
   (they bring their own Redis); Symfony 6.4's cache adapter and the bundled phpredis 6.3 work as-is.
+- Switched Symfony session storage to Redis (default `SESSION_HANDLER_DSN=${REDIS_CACHE_DSN}`); set
+  `SESSION_HANDLER_DSN=` empty to fall back to PHP's native file handler. Removes the per-session
+  `flock` that serialised parallel session-touching requests and lets sessions survive container
+  restarts; multi-pod deployments now share session state without sticky routing.
 
 ## [3.0.0-rc2] - 2026-05-05
 

config/packages/framework.yaml

@@ -9,7 +9,13 @@ framework:
     # Enables session support. Note that the session will ONLY be started if you read or write from it.
     # Remove or comment this section to explicitly disable session support.
     session:
-        handler_id: null
+        # Empty falls back to PHP's native file handler; a `redis://...` DSN
+        # makes Symfony auto-build a RedisSessionHandler. See SESSION_HANDLER_DSN
+        # in .env. Redis-backed sessions remove the per-session flock that
+        # serialises parallel requests on the file handler and survive
+        # container restarts; local dev gets the same behaviour because the
+        # default DSN points at the compose Redis.
+        handler_id: '%env(SESSION_HANDLER_DSN)%'
         cookie_secure: auto
         cookie_samesite: lax
         storage_factory_id: session.storage.factory.native
@@ -33,4 +39,8 @@ when@test:
     framework:
         test: true
         session:
+            # MockFileSessionStorage keeps tests off Redis; force handler_id
+            # back to native so the Redis handler service isn't compiled
+            # against an env that may not point at a reachable Redis.
+            handler_id: null
             storage_factory_id: session.storage.factory.mock_file