Avoid Starting Sessions for Anonymous Users

Sessionsin Symfony applicationsare automatically started wheneverthey are necessary.

This includes writing in theuser'ssession, creating a flash message and logging

added to every user request.

Sessions are automatically started wheneveryou read, write or even check for the

existence of data in the session. This means that if you need to avoid creating

accessing the session.

template code commonly used to display flash messages:

that a session is *always* started:

..code-block::html+jinja

{% endfor %}

Even if the user is not logged in and even if you haven't created any flash message,

just calling the ``get()`` method of the ``flashbag`` will start a session. This

may hurt your application performance because all users will receive a session

cookie. To avoid this behavior, add a check before trying to access the flash messages:

just calling the ``get()`` (or even ``has()``) method of the ``flashbag`` will

start a session. This may hurt your application performance because all users will

receive a session cookie. To avoid this behavior, add a check before trying to

access the flash messages:

..code-block::html+jinja

{% if app.session.started %}

{% if app.request.hasPreviousSession %}

{% for flashMessage in app.session.flashbag.get('notice') %}

<div class="flash-notice">

{{ flashMessage }}

</div>

{% endfor %}

{% endif %}

Another scenario where session cookies will be automatically sent is when the

requested URL is covered by a firewall, even when anonymous users can access

to that URL:

..code-block::yaml

This behavior is caused because in Symfony applications, anonymous users are

technically authenticated.