Sessions and Cookies inside CurrentUser

[xepozz]

CurrentUser should not depend on session/cookies or something runtime-dependent

[samdark]

Where should it store its data then?

[xepozz]

LoginMiddleware / CookieLoginMiddleware or any others

[klsoft-web]

I don't think this issue is relevant to the yiisoft/user package, so it should be closed.
Perhaps the author was misled by the name of the package.
A more appropriate name for the package would be yiisoft/auth-session, since it uses sessions to save and retrieve identity information, in a similar way to the yiisoft/auth-jwt package, which uses JWT tokens from the header to retrieve identity information.
Please also note that the Yiisoft\Session\Session class has a handler that allows you to save and retrieve session information from any source.
Therefore, any abstraction needs to be related to the yiisoft/auth package.