symfony · fabpot · May 5, 2023 · May 3, 2023 · themasch · Jul 8, 2024
diff --git a/src/Symfony/Bundle/WebProfilerBundle/Controller/ProfilerController.php b/src/Symfony/Bundle/WebProfilerBundle/Controller/ProfilerController.php
@@ -128,7 +128,9 @@ public function toolbarAction(Request $request, string $token = null): Response
             throw new NotFoundHttpException('The profiler must be enabled.');
         }
 
-        if ($request->hasSession() && ($session = $request->getSession())->isStarted() && $session->getFlashBag() instanceof AutoExpireFlashBag) {
+        if (!$request->attributes->getBoolean('_stateless') && $request->hasSession()
+            && ($session = $request->getSession())->isStarted() && $session->getFlashBag() instanceof AutoExpireFlashBag
+        ) {
             // keep current flashes for one more request if using AutoExpireFlashBag
             $session->getFlashBag()->setAll($session->getFlashBag()->peekAll());
         }
@@ -172,7 +174,11 @@ public function searchBarAction(Request $request): Response
 
         $this->cspHandler?->disableCsp();
 
-        $session = $request->hasSession() ? $request->getSession() : null;
+
+        $session = null;
+        if ($request->attributes->getBoolean('_stateless') && $request->hasSession()) {
+            $session = $request->getSession();
+        }
 
         return new Response(
             $this->twig->render('@WebProfiler/Profiler/search.html.twig', [
@@ -247,7 +253,7 @@ public function searchAction(Request $request): Response
         $limit = $request->query->get('limit');
         $token = $request->query->get('token');
 
-        if ($request->hasSession()) {
+        if (!$request->attributes->getBoolean('_stateless') && $request->hasSession()) {
             $session = $request->getSession();
 
             $session->set('_profiler_search_ip', $ip);