How to disable a session in a module?

Question

Yii

I'm doing it in the REST API module, I need to disable sessions. Doesn't come out...

Module - API

namespace app\modules\api;
class API extends \yii\base\Module
{
    public $controllerNamespace = 'app\modules\api\controllers';

    public function init()
    {
        parent::init();
        $this->layout = false;
        \Yii::$app->user->enableSession = false;
        \Yii::$app->user->enableAutoLogin = false;
        \Yii::$app->setComponents(require(__DIR__ . '/config.php'));
    }
}

To it config.php

return [
    'response' => [
        'class' => '\yii\web\Response',
        'format' => \yii\web\Response::FORMAT_JSON,
    ],
    'request' => [
        'class' => '\yii\web\Request',
        'enableCsrfValidation' => false,
        'enableCookieValidation' => false,
        'enableCsrfCookie' => false,
    ],
];

And a controller like this:

namespace app\modules\api\controllers;

class SignalController extends \yii\web\Controller
{

    public function behaviors()
    {
        return [
            'authenticator' => [
                'class' => \yii\filters\auth\HttpBearerAuth::className(),
            ]
        ];
    }

    public function actionIndex()
    {
        return ['enableSession'=>Yii::$app->user->enableSession];
    }

}

When contacting the address, I transfer the token. I check it in the User.php model

public static function findIdentityByAccessToken($token, $type = null) {
        return static::find()
            ->where(['access_token' => $token])
            ->andWhere(['>=', 'access_token_expires', new Expression('CURRENT_TIMESTAMP')])
            ->one();
    }

Authorization is successful, but a session is created with the following content:
__flash|a:0:{}
As if somewhere there is an appeal to
Yii::$app->session->setFlash

Everything I looked through, I didn’t find it, maybe there are thoughts where to dig? And why is the session still being created, even though I specified \Yii::$app->user->enableSession = false;

Answer 1

I figured it out, the session was launched by a custom UrlManager manager - codemix\localeurls\UrlManager