Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 8d7cabd

Browse files
fabpotfabpot
committed
feature #10931 [HttpFoundation] enhance PdoSessionHandler (Tobion)
This PR was merged into the 2.6-dev branch. Discussion ---------- [HttpFoundation] enhance PdoSessionHandler | Q | A | ------------- | --- | Bug fix? | yes | New feature? | yes | BC breaks? | yes | Deprecations? | no | Tests pass? | yes | Fixed tickets | #5483, #2067, #2382, #9029 | License | MIT 0. [x] Continuation of locking implementation (#10908): Implement different locking strategies - `PdoSessionHandler::LOCK_TRANSACTIONAL` (default): Issues a real row lock but requires a transaction - `PdoSessionHandler::LOCK_ADVISORY`: app-level lock, safe as long as only the PdoSessionHandler accesses sessions, advantage is it does not require a transaction (not implemented for oracle or sqlsrv yet) - `PdoSessionHandler::LOCK_NONE`: basically what is was before, prone to race conditions, means the last session write wins 1. [x] Save session data as binary: Encoding session data was definitely the wrong solution. Session data is binary text (esp. when using other session.serialize_handler) that must stay as-is and thus must also be safed in a binary column. Base64 encoding session data just decreses performance and increases storage costs and is semantically wrong because it does not have a character encoding. That saving null bytes in Posgres won't work on a character column is also documented > First, binary strings specifically allow storing octets of value zero and other "non-printable" octets (usually, octets outside the range 32 to 126). Character strings disallow zero octets, and also disallow any other octet values and sequences of octet values that are invalid according to the database's selected character set encoding. http://www.postgresql.org/docs/9.1/static/datatype-binary.html#DATATYPE-BINARY-TABLE 2. [x] Implement lazy connections that are only opened when session is used by either passing a dsn string explicitly or falling back to session.save_path ini setting. Fixes #9029 3. [x] add a create table method that creates the correct table depending on database vendor. This makes the class self-documenting and standalone useable. 5. [x] add lifetime column to session table which allows to have different lifetimes for each session 6. [x] add isSessionExpired() method to be able to distinguish between a new session and one that expired due to inactivity, e.g. to display flash message to user 7. [x] added upgrade and changelog notes Commits ------- 1bc6680 [HttpFoundation] implement different locking strategies for sessions 6f5748e adjust sqlite table definition 5978fcf added upgrade and changelog notes for PdoSessionHandler 182a5d3 [HttpFoundation] add create table method to pdo session handler e79229d [HttpFoundation] allow different lifetime per session af1bb1f add test for null byte in session data 251238d [HttpFoundation] implement lazy connect for pdo session handler 7dad54c [HttpFoundation] remove base64 encoding of session data
2 parents d318e09 + 1bc6680 commit 8d7cabd

File tree

4 files changed

+580
-166
lines changed

4 files changed

+580
-166
lines changed

‎UPGRADE-2.6.md

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
UPGRADE FROM 2.5 to 2.6
1+
UPGRADE FROM 2.5 to 2.6
22
=======================
33

44
Form
@@ -101,3 +101,30 @@ Security
101101
@security.token_storage => getToken()
102102
@security.token_storage => setToken()
103103
```
104+
105+
HttpFoundation
106+
--------------
107+
108+
* The `PdoSessionHandler` to store sessions in a database changed significantly.
109+
- By default, it now implements session locking to prevent loss of data by concurrent access to the same session.
110+
- It does so using a transaction between opening and closing a session. For this reason, it's not
111+
recommended to use the same database connection that you also use for your application logic.
112+
Otherwise you have to make sure to access your database after the session is closed and committed.
113+
Instead of passing an existing connection to the handler, you can now also pass a DSN string which
114+
will be used to lazy-connect when a session is started.
115+
- Since accessing a session now blocks when the same session is still open, it is best practice to
116+
save the session as soon as you don't need to write to it anymore. For example, read-only AJAX
117+
request to a session can save the session immediately after opening it to increase concurrency.
118+
- As alternative to transactional locking you can also use advisory locks which do not require a transaction.
119+
Additionally, you can also revert back to no locking in case you have custom logic to deal with race conditions
120+
like an optimistic concurrency control approach. The locking strategy can be chosen by passing the corresponding
121+
constant as `lock_mode` option, e.g. `new PdoSessionHandler($pdoOrDsn, array('lock_mode' => PdoSessionHandler::LOCK_NONE))`.
122+
For more information please read the class documentation.
123+
- The expected schema of the table changed.
124+
- Session data is binary text that can contain null bytes and thus should also be saved as-is in a
125+
binary column like BLOB. For this reason, the handler does not base64_encode the data anymore.
126+
- A new column to store the lifetime of a session is required. This allows to have different
127+
lifetimes per session configured via session.gc_maxlifetime ini setting.
128+
- You would need to migrate the table manually if you want to keep session information of your users.
129+
- You could use `PdoSessionHandler::createTable` to initialize a correctly defined table depending on
130+
the used database vendor.

‎src/Symfony/Component/HttpFoundation/CHANGELOG.md

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,17 @@
11
CHANGELOG
22
=========
33

4+
2.6.0
5+
-----
6+
7+
* PdoSessionHandler changes
8+
- implemented different session locking strategies to prevent loss of data by concurrent access to the same session
9+
- [BC BREAK] save session data in a binary column without base64_encode
10+
- [BC BREAK] added lifetime column to the session table which allows to have different lifetimes for each session
11+
- implemented lazy connections that are only opened when a session is used by either passing a dsn string
12+
explicitly or falling back to session.save_path ini setting
13+
- added a createTable method that initializes a correctly defined table depending on the database vendor
14+
415
2.5.0
516
-----
617

0 commit comments

Comments
 (0)