Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:70126
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.215.44 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CADajX4ChvbT9JtSS=ViKWUM7f=Wq0W0rF8T-G1zhw1WwdHZ_AQ@mail.gmail.com>
References: <CAGa2bXb7hR=jkHnxrBDXnSZkN7B6cDVPj_Nve2=tWS4_AmmOKg@mail.gmail.com>
 <CAGa2bXY9cXzRSeh9J5jaSjLe8GZjLFZQ5g4i-_ZTHBF1pAfVQw@mail.gmail.com> <CADajX4ChvbT9JtSS=ViKWUM7f=Wq0W0rF8T-G1zhw1WwdHZ_AQ@mail.gmail.com>
Date: Fri, 15 Nov 2013 05:36:27 +0900
Message-ID: <CAGa2bXb8QxN8hz9nyUfNOVLmTp91j05PPxiq96zLU9v-TN-3Mw@mail.gmail.com>
To: Adam Harvey <aharvey@php.net>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=089e0158b5389d579704eb290b61
Subject: Re: [PHP-DEV] Re: Session cache, lock and write
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--089e0158b5389d579704eb290b61
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hi Adam,

On Fri, Nov 15, 2013 at 5:00 AM, Adam Harvey <aharvey@php.net> wrote:

> On 14 November 2013 11:54, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> > I also would like to add "session deletion delay" to mitigate session
> > deletion
> > race condition by adding deletion time in session data. (i.e
> > session_regenerate_id(true)
> > may create multiple valid sessions. This can be mitigated by having thi=
s)
> >
> > session.deletion_delay =3D int (by default 0 =3D delete immediately. 10=
 for
> 10
> > sec later)
> >
> > If there is $_SESSION['__SESSION_EXPIRE__'] and expired, new session ID
> is
> > created
> > automatically.
> >
> > I would like to hear comments for this also.
>
> As a nitpick, I think I'd rather this was controlled by a function
> than a magic $_SESSION key, at least in userland =E2=80=94 conceptually, =
it's
> simpler to explain to users if everything in $_SESSION is always
> persisted and it never affects behaviour.
>
> +1 on the idea, though.


Thank you for your comment.

I was wandering which is better, adding new API for expire time or just add
expire time magic value to $_SESSION.

Adding expire time to $_SESSION, is easy and no new API is needed, but
it looks bad, I agree.

Adding new API is clean, but it will requires additional operations to save
handlers which might slow down performance.

Magic value looks bad, while it's simpler and faster. This could be vote
option.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--089e0158b5389d579704eb290b61--