Deprecate custom keys in $_SESSION

Needs tests for the new deprecation. Also needs a CR for sure.

Added a legacy test and a CR.

Looks good!

Left some comments on the MR.

Applied clean-up and D12, IMO looks RTBC and is not disruptive since D8

Feedback appears to be addressed.

In both SessionTestController and LegacySessionController, the method documentation often declared a completely wrong return type:

  * @return string
  *   A notification message.

Since this MR touches a couple of those methods, I fixed them all.

I agree that deprecating direct access to the $_SESSION is not disruptive. However, the next step will be to remove support for custom session keys completely. I.e., SessionManager would stop considering custom keys in $_SESSION when deciding whether to start/save a session automatically.

If contrib and custom code continue to access custom keys, this might or might not work depending on other circumstances (i.e., whether or not some unrelated part of the system is using the session as well). But problems will be hard to diagnose because custom keys are silently ignored when the deprecation and support for custom keys are dropped.

That was the reason I think a longer deprecation period could be worthwhile in this case.

Let’s see what comes from the decision on the policy if some stuff will be pushed to 13

That's for 11.3, not 11.2

Not sure I see the difference if we are still talking about waiting till 13

That's for 11.3, not 11.2

Right, then there is no need to delay the deprecation, I guess.

See 📌 Defer disruptive 11.3 deprecations for removal until 13.0 Active , the Drupal 13 deprecations would start when the 11.3.x branch is open, which is not yet.

I find it good to go and let's discus disruption in 📌 Deprecate custom keys in $_SESSION Active

I mean 📌 Implement Symfony SessionListener Active