Fix cookie conflicts on shared domains

Tagging for framework manager reviews for their thoughts.

Either way think this will require a test case for the new feature.

Also MR has failures.

Thanks for working on this @Darren Oh!

I would say we need to split the patch, because it seems to me that it is combining two separate changes:

Adding a cookie prefix:

@@ -66,13 +67,14 @@ public function getOptions(Request $request) {
   protected function getName(Request $request) {
+    $prefix = Settings::get('session_cookie_prefix', '');
     ...
-    $prefix = $request->isSecure() ? 'SSESS' : 'SESS';
+    $prefix .= $request->isSecure() ? 'SSESS' : 'SESS';

Fixing a problem with overwriting site cookies:

@@ -102,6 +104,10 @@ protected function getUnprefixedName(Request $request) {
+    // Add hash salt to prevent sites on shared domains with separate databases
+    // from overwriting each other's cookies.
+    $session_name .= Settings::get('hash_salt', '');

I think the second change (seems like a bug-fix?) should be in a separate issue. Or the issue title + summary needs to be updated and explained why there are these two changes together. Thanks!

poker10, I have updated the issue description. Both changes are addressing the same bug. The configurable prefix was the original solution, but it requires site owners to take action to prevent the bug. I added the database hash as a more reliable solution that does not require action from site owners. I believe both solutions are required because the issue also affects reverse proxies that filter cookies, and the database hash does not help with that.

This could be tested by leaving the prefix blank, logging into the site, changing the prefix, reloading the site and confirming that the session is no longer logged in, then removing the prefix and confirming the original session is logged in again; might be a little fiddly to do, but it'd be simpler than trying to create concurrent installs of core.

And I suspect the test coverage failures are related to the addition of the hash_salt setting to the session name, maybe this should be optional and it should just use the prefix?