From 6ca7fc946000b1f0c12e593da13d62881f236bb7 Mon Sep 17 00:00:00 2001
From: Nicolas Grekas <nicolas.grekas@gmail.com>
Date: Wed, 11 Mar 2015 15:41:28 +0100
Subject: [PATCH 1/4] Revert "bug #13715 Enforce UTF-8 charset for core
 controllers (WouterJ)"

This reverts commit 463b24b27c15c8b24cdb4925f8772ef53ede9b23, reversing
changes made to c475704c8feaac30ee260a542185a5699eba3d1b.
---
 .../Controller/ExceptionController.php        |   4 +-
 .../Controller/ExceptionControllerTest.php    |   3 +-
 .../Controller/ExceptionController.php        |  19 ++--
 .../Controller/ProfilerController.php         | 104 +++++++-----------
 .../Controller/RouterController.php           |  14 +--
 .../Controller/ProfilerControllerTest.php     |   1 -
 6 files changed, 57 insertions(+), 88 deletions(-)

diff --git a/src/Symfony/Bundle/TwigBundle/Controller/ExceptionController.php b/src/Symfony/Bundle/TwigBundle/Controller/ExceptionController.php
index 39d4aee102..9f1edad12c 100644
--- a/src/Symfony/Bundle/TwigBundle/Controller/ExceptionController.php
+++ b/src/Symfony/Bundle/TwigBundle/Controller/ExceptionController.php
@@ -51,7 +51,7 @@ class ExceptionController
 
         $code = $exception->getStatusCode();
 
-        return Response::create($this->twig->render(
+        return new Response($this->twig->render(
             (string) $this->findTemplate($request, $request->getRequestFormat(), $code, $this->debug),
             array(
                 'status_code' => $code,
@@ -60,7 +60,7 @@ class ExceptionController
                 'logger' => $logger,
                 'currentContent' => $currentContent,
             )
-        ))->setCharset('UTF-8');
+        ));
     }
 
     /**
diff --git a/src/Symfony/Bundle/TwigBundle/Tests/Controller/ExceptionControllerTest.php b/src/Symfony/Bundle/TwigBundle/Tests/Controller/ExceptionControllerTest.php
index 6cdb02f99d..20646f74aa 100644
--- a/src/Symfony/Bundle/TwigBundle/Tests/Controller/ExceptionControllerTest.php
+++ b/src/Symfony/Bundle/TwigBundle/Tests/Controller/ExceptionControllerTest.php
@@ -39,7 +39,6 @@ class ExceptionControllerTest extends TestCase
         $request->headers->set('X-Php-Ob-Level', 1);
 
         $controller = new ExceptionController($twig, false);
-        $response = $controller->showAction($request, $flatten);
-        $this->assertEquals('UTF-8', $response->getCharset(), 'Request charset is explicitly set to UTF-8');
+        $controller->showAction($request, $flatten);
     }
 }
diff --git a/src/Symfony/Bundle/WebProfilerBundle/Controller/ExceptionController.php b/src/Symfony/Bundle/WebProfilerBundle/Controller/ExceptionController.php
index abd75d440e..0b5db752ee 100644
--- a/src/Symfony/Bundle/WebProfilerBundle/Controller/ExceptionController.php
+++ b/src/Symfony/Bundle/WebProfilerBundle/Controller/ExceptionController.php
@@ -62,17 +62,16 @@ class ExceptionController
 
         $code = $exception->getStatusCode();
 
-        return Response::create(
-            $this->twig->render($template, array(
+        return new Response($this->twig->render(
+            $template,
+            array(
                 'status_code' => $code,
                 'status_text' => Response::$statusTexts[$code],
                 'exception' => $exception,
                 'logger' => null,
                 'currentContent' => '',
-            )),
-            200,
-            array('Content-Type' => 'text/html')
-        )->setCharset('UTF-8');
+            )
+        ), 200, array('Content-Type' => 'text/html'));
     }
 
     /**
@@ -98,14 +97,10 @@ class ExceptionController
         if (!$this->templateExists($template)) {
             $handler = new ExceptionHandler();
 
-            $response = new Response($handler->getStylesheet($exception), 200, array('Content-Type' => 'text/css'));
-        } else {
-            $response = new Response($this->twig->render('@WebProfiler/Collector/exception.css.twig'), 200, array('Content-Type' => 'text/css'));
+            return new Response($handler->getStylesheet($exception), 200, array('Content-Type' => 'text/css'));
         }
 
-        $response->setCharset('UTF-8');
-
-        return $response;
+        return new Response($this->twig->render('@WebProfiler/Collector/exception.css.twig'), 200, array('Content-Type' => 'text/css'));
     }
 
     protected function getTemplate()
diff --git a/src/Symfony/Bundle/WebProfilerBundle/Controller/ProfilerController.php b/src/Symfony/Bundle/WebProfilerBundle/Controller/ProfilerController.php
index 2c0d7a795e..173616fd9f 100644
--- a/src/Symfony/Bundle/WebProfilerBundle/Controller/ProfilerController.php
+++ b/src/Symfony/Bundle/WebProfilerBundle/Controller/ProfilerController.php
@@ -99,20 +99,16 @@ class ProfilerController
             throw new NotFoundHttpException(sprintf('Panel "%s" is not available for token "%s".', $panel, $token));
         }
 
-        return Response::create(
-            $this->twig->render($this->getTemplateManager()->getName($profile, $panel), array(
-                'token' => $token,
-                'profile' => $profile,
-                'collector' => $profile->getCollector($panel),
-                'panel' => $panel,
-                'page' => $page,
-                'request' => $request,
-                'templates' => $this->getTemplateManager()->getTemplates($profile),
-                'is_ajax' => $request->isXmlHttpRequest(),
-            )),
-            200,
-            array('Content-Type' => 'text/html')
-        )->setCharset('UTF-8');
+        return new Response($this->twig->render($this->getTemplateManager()->getName($profile, $panel), array(
+            'token' => $token,
+            'profile' => $profile,
+            'collector' => $profile->getCollector($panel),
+            'panel' => $panel,
+            'page' => $page,
+            'request' => $request,
+            'templates' => $this->getTemplateManager()->getTemplates($profile),
+            'is_ajax' => $request->isXmlHttpRequest(),
+        )), 200, array('Content-Type' => 'text/html'));
     }
 
     /**
@@ -151,13 +147,9 @@ class ProfilerController
 
         $this->profiler->disable();
 
-        return Response::create(
-            $this->twig->render('@WebProfiler/Profiler/info.html.twig', array(
-                'about' => $about,
-            )),
-            200,
-            array('Content-Type' => 'text/html')
-        )->setCharset('UTF-8');
+        return new Response($this->twig->render('@WebProfiler/Profiler/info.html.twig', array(
+            'about' => $about,
+        )), 200, array('Content-Type' => 'text/html'));
     }
 
     /**
@@ -205,17 +197,13 @@ class ProfilerController
             // the profiler is not enabled
         }
 
-        return Response::create(
-            $this->twig->render('@WebProfiler/Profiler/toolbar.html.twig', array(
-                'position' => $position,
-                'profile' => $profile,
-                'templates' => $this->getTemplateManager()->getTemplates($profile),
-                'profiler_url' => $url,
-                'token' => $token,
-            )),
-            200,
-            array('Content-Type' => 'text/html')
-        )->setCharset('UTF-8');
+        return new Response($this->twig->render('@WebProfiler/Profiler/toolbar.html.twig', array(
+            'position' => $position,
+            'profile' => $profile,
+            'templates' => $this->getTemplateManager()->getTemplates($profile),
+            'profiler_url' => $url,
+            'token' => $token,
+        )), 200, array('Content-Type' => 'text/html'));
     }
 
     /**
@@ -253,19 +241,15 @@ class ProfilerController
             $token = $session->get('_profiler_search_token');
         }
 
-        return Response::create(
-            $this->twig->render('@WebProfiler/Profiler/search.html.twig', array(
-                'token' => $token,
-                'ip' => $ip,
-                'method' => $method,
-                'url' => $url,
-                'start' => $start,
-                'end' => $end,
-                'limit' => $limit,
-            )),
-            200,
-            array('Content-Type' => 'text/html')
-        )->setCharset('UTF-8');
+        return new Response($this->twig->render('@WebProfiler/Profiler/search.html.twig', array(
+            'token' => $token,
+            'ip' => $ip,
+            'method' => $method,
+            'url' => $url,
+            'start' => $start,
+            'end' => $end,
+            'limit' => $limit,
+        )), 200, array('Content-Type' => 'text/html'));
     }
 
     /**
@@ -295,22 +279,18 @@ class ProfilerController
         $end = $request->query->get('end', null);
         $limit = $request->query->get('limit');
 
-        return Response::create(
-            $this->twig->render('@WebProfiler/Profiler/results.html.twig', array(
-                'token' => $token,
-                'profile' => $profile,
-                'tokens' => $this->profiler->find($ip, $url, $limit, $method, $start, $end),
-                'ip' => $ip,
-                'method' => $method,
-                'url' => $url,
-                'start' => $start,
-                'end' => $end,
-                'limit' => $limit,
-                'panel' => null,
-            )),
-            200,
-            array('Content-Type' => 'text/html')
-        )->setCharset('UTF-8');
+        return new Response($this->twig->render('@WebProfiler/Profiler/results.html.twig', array(
+            'token' => $token,
+            'profile' => $profile,
+            'tokens' => $this->profiler->find($ip, $url, $limit, $method, $start, $end),
+            'ip' => $ip,
+            'method' => $method,
+            'url' => $url,
+            'start' => $start,
+            'end' => $end,
+            'limit' => $limit,
+            'panel' => null,
+        )), 200, array('Content-Type' => 'text/html'));
     }
 
     /**
@@ -384,7 +364,7 @@ class ProfilerController
         phpinfo();
         $phpinfo = ob_get_clean();
 
-        return Response::create($phpinfo, 200, array('Content-Type' => 'text/html'))->setCharset('UTF-8');
+        return new Response($phpinfo, 200, array('Content-Type' => 'text/html'));
     }
 
     /**
diff --git a/src/Symfony/Bundle/WebProfilerBundle/Controller/RouterController.php b/src/Symfony/Bundle/WebProfilerBundle/Controller/RouterController.php
index 800f209a6f..f4a84bf568 100644
--- a/src/Symfony/Bundle/WebProfilerBundle/Controller/RouterController.php
+++ b/src/Symfony/Bundle/WebProfilerBundle/Controller/RouterController.php
@@ -68,14 +68,10 @@ class RouterController
 
         $request = $profile->getCollector('request');
 
-        return Response::create(
-            $this->twig->render('@WebProfiler/Router/panel.html.twig', array(
-                'request' => $request,
-                'router' => $profile->getCollector('router'),
-                'traces' => $matcher->getTraces($request->getPathInfo()),
-            )),
-            200,
-            array('Content-Type' => 'text/html')
-        )->setCharset('UTF-8');
+        return new Response($this->twig->render('@WebProfiler/Router/panel.html.twig', array(
+            'request' => $request,
+            'router' => $profile->getCollector('router'),
+            'traces' => $matcher->getTraces($request->getPathInfo()),
+        )), 200, array('Content-Type' => 'text/html'));
     }
 }
diff --git a/src/Symfony/Bundle/WebProfilerBundle/Tests/Controller/ProfilerControllerTest.php b/src/Symfony/Bundle/WebProfilerBundle/Tests/Controller/ProfilerControllerTest.php
index 3338d8c53b..c10449d323 100644
--- a/src/Symfony/Bundle/WebProfilerBundle/Tests/Controller/ProfilerControllerTest.php
+++ b/src/Symfony/Bundle/WebProfilerBundle/Tests/Controller/ProfilerControllerTest.php
@@ -69,7 +69,6 @@ class ProfilerControllerTest extends \PHPUnit_Framework_TestCase
 
         $response = $controller->toolbarAction(Request::create('/_wdt/found'), 'found');
         $this->assertEquals(200, $response->getStatusCode());
-        $this->assertEquals('UTF-8', $response->getCharset(), 'Request charset is explicitly set to UTF-8');
 
         $response = $controller->toolbarAction(Request::create('/_wdt/notFound'), 'notFound');
         $this->assertEquals(404, $response->getStatusCode());

From cbd0525f8f5c4fa71caf4a6183dbb8cf61256cbc Mon Sep 17 00:00:00 2001
From: Bilal Amarni <bilal.amarni@gmail.com>
Date: Sun, 31 Mar 2013 20:32:41 +0200
Subject: [PATCH 2/4] used HTML5 meta charset tag and removed hardcoded ones

Conflicts:
	src/Symfony/Bundle/SecurityBundle/Tests/Functional/app/Resources/views/base.html.twig
	src/Symfony/Bundle/TwigBundle/Resources/views/Exception/error.html.twig
	src/Symfony/Bundle/TwigBundle/Resources/views/layout.html.twig
---
 .../Tests/Functional/app/Resources/views/base.html.twig       | 2 +-
 .../TwigBundle/Resources/views/Exception/error.html.twig      | 2 +-
 .../WebProfilerBundle/Resources/views/Profiler/base.html.twig | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/Symfony/Bundle/SecurityBundle/Tests/Functional/app/Resources/views/base.html.twig b/src/Symfony/Bundle/SecurityBundle/Tests/Functional/app/Resources/views/base.html.twig
index 4b9151eaf8..58ba1fe89e 100644
--- a/src/Symfony/Bundle/SecurityBundle/Tests/Functional/app/Resources/views/base.html.twig
+++ b/src/Symfony/Bundle/SecurityBundle/Tests/Functional/app/Resources/views/base.html.twig
@@ -1,7 +1,7 @@
 <!DOCTYPE html>
 <html>
     <head>
-        <meta charset="UTF-8" />
+        <meta charset="{{ _charset }}" />
         <title>{% block title %}Welcome!{% endblock %}</title>
         {% block stylesheets %}{% endblock %}
         <link rel="shortcut icon" href="{{ asset('favicon.ico') }}" />
diff --git a/src/Symfony/Bundle/TwigBundle/Resources/views/Exception/error.html.twig b/src/Symfony/Bundle/TwigBundle/Resources/views/Exception/error.html.twig
index 30b51e4760..138a60ad96 100644
--- a/src/Symfony/Bundle/TwigBundle/Resources/views/Exception/error.html.twig
+++ b/src/Symfony/Bundle/TwigBundle/Resources/views/Exception/error.html.twig
@@ -1,7 +1,7 @@
 <!DOCTYPE html>
 <html>
     <head>
-        <meta charset="UTF-8" />
+        <meta charset="{{ _charset }}" />
         <title>An Error Occurred: {{ status_text }}</title>
     </head>
     <body>
diff --git a/src/Symfony/Bundle/WebProfilerBundle/Resources/views/Profiler/base.html.twig b/src/Symfony/Bundle/WebProfilerBundle/Resources/views/Profiler/base.html.twig
index e4258a205d..3567708a72 100644
--- a/src/Symfony/Bundle/WebProfilerBundle/Resources/views/Profiler/base.html.twig
+++ b/src/Symfony/Bundle/WebProfilerBundle/Resources/views/Profiler/base.html.twig
@@ -1,8 +1,8 @@
 <!DOCTYPE html>
 <html lang="en">
     <head>
-        <meta charset="UTF-8">
-        <meta name="robots" content="noindex,nofollow">
+        <meta charset="{{ _charset }}" />
+        <meta name="robots" content="noindex,nofollow" />
         <title>{% block title 'Profiler' %}</title>
         <link rel="icon" type="image/x-icon" sizes="16x16" href="data:image/ico;base64,AAABAAEAEBAAAAEAIABoBAAAFgAAACgAAAAQAAAAIAAAAAEAIAAAAAAAAAQAABMLAAATCwAAAAAAAAAAAAAAAAAAAAAAADIvMQAyLzEIMi8xSzEuMKoyLzHkMi8x/TIvMf0yLzHlMi8xrDIvMU4yLzEJMi8xAAAAAAAAAAAAAAAAADIvMQAyLzEYMS4wkTMwMu45Njj/MS4w/zEuMP8yLzH/Mi8x/zIvMf8yLzHvMi8xlDIvMRkyLzEAAAAAADIvMQAyLzEXMS4wrTk2OPyVk5T7kI6P/nl3ef8+Oz3/MS4w/zIvMf8yLzH/Mi8x/zIvMf4yLzGxMi8xGjIvMQAyLzEGMi8xkDEuMP4/PD79wcDA+oB+gP6Ni4z/paOk/zk2OP8xLjD/Mi8x/zIvMf8yLzH/Mi8x/zIvMZQyLzEIMi8xSTIvMewyLzH/MS4w/z06PP81MjT+TktN/93c3f97eXv/MC0v/zIvMf8yLzH/Mi8x/zIvMf8yLzHuMi8xTzIvMaUyLzH/Mi8x/0lHSf9kYmP/XFpb/zs4Ov/DwsL+ycjI/zs4Ov8xLjD/Mi8x/zIvMf8yLzH/Mi8x/zIvMawyLzHfMC0v/1tYWv+opqf/YV5g/8bFxf96eHn+m5qb/u7u7v9WVFX/MC0v/zIvMf8yLzH/Mi8x/zIvMf8yLzHkMi8x+jAtL/9iYGH/mZiZ/2dlZv/p6On/oJ+g/np4ev/6+vr/dXN1/y0qLP8xLjD/Mi8x/zIvMf8yLzH/Mi8x/DIvMfoyLzH/MzAy/0A+QP7JyMj85eXl/1tYWv9XVVf/8fDx/6qpqv9ZV1j/Q0BC/zIvMf8yLzH/Mi8x/zIvMfwyLzHeMi8x/zEuMP8/PD762dnZ9JWTlP81MjT/ZmRm/+Dg4P/DwsP/YV5g/6Wkpf9BPkD/MS4w/zIvMf8yLzHjMi8xozIvMf8yLzH/Mi8x/nZ0dv2amJn4dXN0+V5bXf+Pjo//0tLS/0hFR/9vbG7/Ozg6/zEuMP8yLzH/Mi8xqTIvMUcyLzHrMi8x/zIvMf8xLjD/Ozg6/Do3OfwwLS//REFD/728vP9nZWb/TktN/4mIif05Nzn/Mi8x7jMwMkwyLzEGMi8xjDIvMf4yLzH/Mi8x/zIvMf8yLzH/Mi8x/zAtL/9XVFb/goGC+Hx6e+6qqanwOzg6/DMwMpJDQEIIMi8xADIvMRUyLzGrMi8x/jIvMf8yLzH/Mi8x/zIvMf8yLzH/MS4w/zg2N/xBPkD3OTY4/DIvMa8yLzEYMi8xAAAAAAAyLzEAMi8xGDIvMY0yLzHqMi8x/zIvMf8yLzH/Mi8x/zIvMf8yLzH/MS4w7DEuMJEyLzEaMi8xAAAAAAAAAAAAAAAAADIvMQAyLzEGMi8xQzIvMZ4yLzHdMi8x+jIvMfoyLzHeMi8xoDIvMUUyLzEGMi8xAAAAAAAAAAAA4AcAAMADAACAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIABAADAAwAA4AcAAA==">
         <style>

From ef410597a68ec00703176ec17d4691d81a135053 Mon Sep 17 00:00:00 2001
From: Nicolas Grekas <nicolas.grekas@gmail.com>
Date: Wed, 11 Mar 2015 16:56:34 +0100
Subject: [PATCH 3/4] [WebProfilerBundle] Set debug+charset on the
 ExceptionHandler fallback

---
 .../WebProfilerBundle/Controller/ExceptionController.php      | 4 ++--
 src/Symfony/Component/Debug/ExceptionHandler.php              | 3 ++-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/Symfony/Bundle/WebProfilerBundle/Controller/ExceptionController.php b/src/Symfony/Bundle/WebProfilerBundle/Controller/ExceptionController.php
index 0b5db752ee..fd0dbecd2b 100644
--- a/src/Symfony/Bundle/WebProfilerBundle/Controller/ExceptionController.php
+++ b/src/Symfony/Bundle/WebProfilerBundle/Controller/ExceptionController.php
@@ -55,7 +55,7 @@ class ExceptionController
         $template = $this->getTemplate();
 
         if (!$this->twig->getLoader()->exists($template)) {
-            $handler = new ExceptionHandler();
+            $handler = new ExceptionHandler($this->debug, $this->twig->getCharset());
 
             return new Response($handler->getContent($exception), 200, array('Content-Type' => 'text/html'));
         }
@@ -95,7 +95,7 @@ class ExceptionController
         $template = $this->getTemplate();
 
         if (!$this->templateExists($template)) {
-            $handler = new ExceptionHandler();
+            $handler = new ExceptionHandler($this->debug, $this->twig->getCharset());
 
             return new Response($handler->getStylesheet($exception), 200, array('Content-Type' => 'text/css'));
         }
diff --git a/src/Symfony/Component/Debug/ExceptionHandler.php b/src/Symfony/Component/Debug/ExceptionHandler.php
index f429add39e..042f3e7239 100644
--- a/src/Symfony/Component/Debug/ExceptionHandler.php
+++ b/src/Symfony/Component/Debug/ExceptionHandler.php
@@ -92,6 +92,7 @@ class ExceptionHandler
             foreach ($exception->getHeaders() as $name => $value) {
                 header($name.': '.$value, false);
             }
+            header('Content-Type: text/html; charset='.$this->charset);
         }
 
         echo $this->decorate($this->getContent($exception), $this->getStylesheet($exception));
@@ -110,7 +111,7 @@ class ExceptionHandler
             $exception = FlattenException::create($exception);
         }
 
-        return new Response($this->decorate($this->getContent($exception), $this->getStylesheet($exception)), $exception->getStatusCode(), $exception->getHeaders());
+        return Response::create($this->decorate($this->getContent($exception), $this->getStylesheet($exception)), $exception->getStatusCode(), $exception->getHeaders())->setCharset($this->charset);
     }
 
     /**

From 8289ec35b3f475cf369d518da615c0eb780adc5d Mon Sep 17 00:00:00 2001
From: Benjamin Zikarsky <benjamin@zikarsky.de>
Date: Wed, 19 Nov 2014 13:44:15 +0100
Subject: [PATCH 4/4] [HttpFoundation] MongoDbSessionHandler::read() now checks
 for valid session age

---
 .../Storage/Handler/MongoDbSessionHandler.php | 47 ++++++++++++-------
 .../Handler/MongoDbSessionHandlerTest.php     | 46 ++++++++++++++++--
 2 files changed, 74 insertions(+), 19 deletions(-)

diff --git a/src/Symfony/Component/HttpFoundation/Session/Storage/Handler/MongoDbSessionHandler.php b/src/Symfony/Component/HttpFoundation/Session/Storage/Handler/MongoDbSessionHandler.php
index 04d76b5d93..3876434ebe 100644
--- a/src/Symfony/Component/HttpFoundation/Session/Storage/Handler/MongoDbSessionHandler.php
+++ b/src/Symfony/Component/HttpFoundation/Session/Storage/Handler/MongoDbSessionHandler.php
@@ -42,6 +42,24 @@ class MongoDbSessionHandler implements \SessionHandlerInterface
      *  * id_field: The field name for storing the session id [default: _id]
      *  * data_field: The field name for storing the session data [default: data]
      *  * time_field: The field name for storing the timestamp [default: time]
+     *  * expiry_field: The field name for storing the expiry-timestamp [default: expires_at]
+     *
+     * It is strongly recommended to put an index on the `expiry_field` for
+     * garbage-collection. Alternatively it's possible to automatically expire
+     * the sessions in the database as described below:
+     *
+     * A TTL collections can be used on MongoDB 2.2+ to cleanup expired sessions
+     * automatically. Such an index can for example look like this:
+     *
+     *     db.<session-collection>.ensureIndex(
+     *         { "<expiry-field>": 1 },
+     *         { "expireAfterSeconds": 0 }
+     *     )
+     *
+     * More details on: http://docs.mongodb.org/manual/tutorial/expire-data/
+     *
+     * If you use such an index, you can drop `gc_probability` to 0 since
+     * no garbage-collection is required.
      *
      * @param \Mongo|\MongoClient $mongo   A MongoClient or Mongo instance
      * @param array               $options An associative array of field options
@@ -65,6 +83,7 @@ class MongoDbSessionHandler implements \SessionHandlerInterface
             'id_field' => '_id',
             'data_field' => 'data',
             'time_field' => 'time',
+            'expiry_field' => 'expires_at',
         ), $options);
     }
 
@@ -101,18 +120,8 @@ class MongoDbSessionHandler implements \SessionHandlerInterface
      */
     public function gc($maxlifetime)
     {
-        /* Note: MongoDB 2.2+ supports TTL collections, which may be used in
-         * place of this method by indexing the "time_field" field with an
-         * "expireAfterSeconds" option. Regardless of whether TTL collections
-         * are used, consider indexing this field to make the remove query more
-         * efficient.
-         *
-         * See: http://docs.mongodb.org/manual/tutorial/expire-data/
-         */
-        $time = new \MongoDate(time() - $maxlifetime);
-
         $this->getCollection()->remove(array(
-            $this->options['time_field'] => array('$lt' => $time),
+            $this->options['expiry_field'] => array('$lt' => new \MongoDate()),
         ));
 
         return true;
@@ -123,12 +132,17 @@ class MongoDbSessionHandler implements \SessionHandlerInterface
      */
     public function write($sessionId, $data)
     {
+        $expiry = new \MongoDate(time() + (int) ini_get('session.gc_maxlifetime'));
+
+        $fields = array(
+            $this->options['data_field'] => new \MongoBinData($data, \MongoBinData::BYTE_ARRAY),
+            $this->options['time_field'] => new \MongoDate(),
+            $this->options['expiry_field'] => $expiry,
+        );
+
         $this->getCollection()->update(
             array($this->options['id_field'] => $sessionId),
-            array('$set' => array(
-                $this->options['data_field'] => new \MongoBinData($data, \MongoBinData::BYTE_ARRAY),
-                $this->options['time_field'] => new \MongoDate(),
-            )),
+            array('$set' => $fields),
             array('upsert' => true, 'multiple' => false)
         );
 
@@ -141,7 +155,8 @@ class MongoDbSessionHandler implements \SessionHandlerInterface
     public function read($sessionId)
     {
         $dbData = $this->getCollection()->findOne(array(
-            $this->options['id_field'] => $sessionId,
+            $this->options['id_field']   => $sessionId,
+            $this->options['expiry_field'] => array('$gte' => new \MongoDate()),
         ));
 
         return null === $dbData ? '' : $dbData[$this->options['data_field']]->bin;
diff --git a/src/Symfony/Component/HttpFoundation/Tests/Session/Storage/Handler/MongoDbSessionHandlerTest.php b/src/Symfony/Component/HttpFoundation/Tests/Session/Storage/Handler/MongoDbSessionHandlerTest.php
index d5db694c05..c4031d8c1c 100644
--- a/src/Symfony/Component/HttpFoundation/Tests/Session/Storage/Handler/MongoDbSessionHandlerTest.php
+++ b/src/Symfony/Component/HttpFoundation/Tests/Session/Storage/Handler/MongoDbSessionHandlerTest.php
@@ -40,6 +40,7 @@ class MongoDbSessionHandlerTest extends \PHPUnit_Framework_TestCase
             'id_field' => '_id',
             'data_field' => 'data',
             'time_field' => 'time',
+            'expiry_field' => 'expires_at',
             'database' => 'sf2-test',
             'collection' => 'session-test',
         );
@@ -73,6 +74,42 @@ class MongoDbSessionHandlerTest extends \PHPUnit_Framework_TestCase
         $this->assertTrue($this->storage->close(), 'The "close" method should always return true');
     }
 
+    public function testRead()
+    {
+        $collection = $this->createMongoCollectionMock();
+
+        $this->mongo->expects($this->once())
+            ->method('selectCollection')
+            ->with($this->options['database'], $this->options['collection'])
+            ->will($this->returnValue($collection));
+
+        $that = $this;
+
+        // defining the timeout before the actual method call
+        // allows to test for "greater than" values in the $criteria
+        $testTimeout = time();
+
+        $collection->expects($this->once())
+            ->method('findOne')
+            ->will($this->returnCallback(function ($criteria) use ($that, $testTimeout) {
+                $that->assertArrayHasKey($that->options['id_field'], $criteria);
+                $that->assertEquals($criteria[$that->options['id_field']], 'foo');
+
+                $that->assertArrayHasKey($that->options['expiry_field'], $criteria);
+                $that->assertArrayHasKey('$gte', $criteria[$that->options['expiry_field']]);
+                $that->assertInstanceOf('MongoDate', $criteria[$that->options['expiry_field']]['$gte']);
+                $that->assertGreaterThanOrEqual($criteria[$that->options['expiry_field']]['$gte']->sec, $testTimeout);
+
+                return array(
+                    $that->options['id_field'] => 'foo',
+                    $that->options['data_field'] => new \MongoBinData('bar', \MongoBinData::BYTE_ARRAY),
+                    $that->options['id_field'] => new \MongoDate(),
+                );
+            }));
+
+        $this->assertEquals('bar', $this->storage->read('foo'));
+    }
+
     public function testWrite()
     {
         $collection = $this->createMongoCollectionMock();
@@ -94,10 +131,13 @@ class MongoDbSessionHandlerTest extends \PHPUnit_Framework_TestCase
                 $data = $updateData['$set'];
             }));
 
+        $expectedExpiry = time() + (int) ini_get('session.gc_maxlifetime');
         $this->assertTrue($this->storage->write('foo', 'bar'));
 
         $this->assertEquals('bar', $data[$this->options['data_field']]->bin);
         $that->assertInstanceOf('MongoDate', $data[$this->options['time_field']]);
+        $this->assertInstanceOf('MongoDate', $data[$this->options['expiry_field']]);
+        $this->assertGreaterThanOrEqual($expectedExpiry, $data[$this->options['expiry_field']]->sec);
     }
 
     public function testReplaceSessionData()
@@ -153,11 +193,11 @@ class MongoDbSessionHandlerTest extends \PHPUnit_Framework_TestCase
         $collection->expects($this->once())
             ->method('remove')
             ->will($this->returnCallback(function ($criteria) use ($that) {
-                $that->assertInstanceOf('MongoDate', $criteria[$that->options['time_field']]['$lt']);
-                $that->assertGreaterThanOrEqual(time() - -1, $criteria[$that->options['time_field']]['$lt']->sec);
+                $that->assertInstanceOf('MongoDate', $criteria[$that->options['expiry_field']]['$lt']);
+                $that->assertGreaterThanOrEqual(time() - 1, $criteria[$that->options['expiry_field']]['$lt']->sec);
             }));
 
-        $this->assertTrue($this->storage->gc(-1));
+        $this->assertTrue($this->storage->gc(1));
     }
 
     private function createMongoCollectionMock()