# PHP SDK Initialization - sessionStorage

**URL:** <https://community.auth0.com/t/php-sdk-initialization-sessionstorage/90454>\
**Category:** Get Help\
**Tags:** php\
**Created:** [September 12, 2022, 4:44pm UTC](https://community.auth0.com/t/php-sdk-initialization-sessionstorage/90454 "2022-09-12T16:44:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![auth0man](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/auth0man/32/14799_2.png) [@auth0man](https://community.auth0.com/u/auth0man)\
**Post date:** [September 12, 2022, 4:44pm UTC](https://community.auth0.com/t/php-sdk-initialization-sessionstorage/90454/1 "2022-09-12T16:44:58Z")

</div>

- Which SDK this is regarding: PHP
- SDK Version: 8.2.1
- Platform Version: Ubuntu 20.04.5 LTS

I don’t understand the SDK configuration process for using PHP session storage.

```auto
$sessionStorage StoreInterface|null Defaults to use cookies. A StoreInterface-compatible class for storing Token state.

```

In order to use PHP sessions I need to supply an instance of Auth0\SDK\Store\SessionStore when creating a SdkConfiguration instance. According to the readme this is the preferred way of doing it:

> When configuring the SDK, you can instantiate `SdkConfiguration` and pass options as named arguments in PHP 8 (strongly recommended)

So my code needs to look like this:

```auto
$configuration = new SdkConfiguration(
    // The values below are found in the Auth0 dashboard, under application settings:
    domain: '{{YOUR_TENANT}}.auth0.com',
    clientId: '{{YOUR_APPLICATION_CLIENT_ID}}',
    sessionStorage : $mySessionStoreInstance
);

```

In order to create a sessionStore instance I need to supply a SdkConfiguration instance:

```auto
$mySessionStoreInstance = new SdkConfiguration(
     domain: '{{YOUR_TENANT}}.auth0.com',
    clientId: '{{YOUR_APPLICATION_CLIENT_ID}}',
);

```

Supplying the same parameters again seems strange and pointless - but when I do it the SdkConfiguration constructor throws an exception : `\Auth0\SDK\Exception\ConfigurationException::requiresCookieSecret()`  
because no cookie secret has been passed in the configuration options.

Well - the whole point of using sessionStore was to not use cookies!

I can structure the code like this:

```auto
    $params = [
        domain: '{{YOUR_TENANT}}.auth0.com',
        clientId: '{{YOUR_APPLICATION_CLIENT_ID}}',
        cookieSecret: '{{MY_COOKIE_SCERET}}'
        ];

        $sessionStore = new SessionStore( new SdkConfiguration($params) );
        $params['sessionStorage'] = $sessionStore;

        return new Auth0( new SdkConfiguration($params) );

```

So, I’m creating a config in order to create a sessionStore instance which I then need to add back into the config parameters in order to finally configure the SDK.

And I still need to supply a cookieSecret in order not to use cookies!  
And I don’t get to use any nice named parameters!

Is there a better way of coding this - one that uses named parameters?

---

<div class="post-metadata">

**Author:** ![shunsuke.tsutsui](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/shunsuke.tsutsui/32/20393_2.png) [@shunsuke.tsutsui](https://community.auth0.com/u/shunsuke.tsutsui)\
**Post date:** [October 14, 2022, 5:50am UTC](https://community.auth0.com/t/php-sdk-initialization-sessionstorage/90454/2 "2022-10-14T05:50:29Z")

</div>

You can write as follows so that no need to create SdkConfiguration twice.

```auto
        $this->configuration = new SdkConfiguration([
            'domain' => $env['AUTH0_DOMAIN'] ?? null,
            'customDomain' => $env['AUTH0_CUSTOM_DOMAIN'] ?? null,
            'clientId' => $env['AUTH0_CLIENT_ID'] ?? null,
            'clientSecret' => $env['AUTH0_CLIENT_SECRET'] ?? null,
            'cookieSecret' => $env['AUTH0_COOKIE_SECRET'] ?? null,
            'cookieExpires' => (int) ($env['AUTH0_COOKIE_EXPIRES'] ?? 60 * 60 * 24),
            'audience' => ($env['AUTH0_AUDIENCE'] ?? null) !== null ? [trim($env['AUTH0_AUDIENCE'])] : null,
            'organization' => ($env['AUTH0_ORGANIZATION'] ?? null) !== null ? [trim($env['AUTH0_ORGANIZATION'])] : null,
        ]);
        $sessionStore = new SessionStore($this->configuration);
        $this->configuration->setSessionStorage($sessionStore);

```

> And I still need to supply a cookieSecret in order not to use cookies!

Whether it’s good or bad, the SDK uses CookieStore as default. so that’s why.

> <https://github.com/auth0/auth0-PHP/blob/21abc9550442a45ee9245b2581d7dd8e60977a18/src/Configuration/SdkConfiguration.php#L425-L434>

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [November 15, 2024, 9:36pm UTC](https://community.auth0.com/t/php-sdk-initialization-sessionstorage/90454/3 "2024-11-15T21:36:20Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.