Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:92424
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.46 as permitted sender)
To: Andrey Andreev <narf@devilix.net>, Yasuo Ohgaki <yohgaki@ohgaki.net>
References: <CAGa2bXb-jON8qZyje_ETckyO-KCmcbhTjcJt=NJZ1agAgzqMoQ@mail.gmail.com>
 <CAPhkiZx7zc1=1zyx=vJvZtr7x7OhktDFCHMK4GdOCD_DSqbKCg@mail.gmail.com>
 <CAGa2bXaZnsGnrKAAPmxHG+hut3+1=8bdOER--WrsXXowoiXu=A@mail.gmail.com>
 <CAPhkiZyHruaK9NM4C-4PcQ-2x4QK52Lv+JAyhLHoP=ufcufjWw@mail.gmail.com>
 <CAGa2bXb14ucv2PyHeVHMTcvUrqXD+QehqYHiBZtsqcXW1tgjXA@mail.gmail.com>
 <570D2F74.7060702@gmail.com>
 <CAGa2bXaysM4jcdOzW9ZXzFD_XOgkxphTH_JC0__HEYTNeCniHw@mail.gmail.com>
 <CAPhkiZxt--wdXcNVU4yDKxeJHqBhjECMUH65gyEzscHZQMy0Dg@mail.gmail.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Message-ID: <57152DAD.6000002@gmail.com>
Date: Mon, 18 Apr 2016 11:55:41 -0700
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:38.0)
 Gecko/20100101 Thunderbird/38.7.1
MIME-Version: 1.0
In-Reply-To: <CAPhkiZxt--wdXcNVU4yDKxeJHqBhjECMUH65gyEzscHZQMy0Dg@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] [RFC][Discussion] Add session_gc()
From: smalyshev@gmail.com (Stanislav Malyshev)

Hi!

>> Document calling session_gc() periodically is the best practice.
> 
> If you want to document usage of this new API as the best practice, it
> would be unfair to the users if you don't also document the caveats that
> come with it:

I also think it's wrong to document it so. While having periodical GC is
the best practice, probabilistic GC *is* calling GC periodically. True,
for some exceptional scenarios - like sites with very low traffic - the
period is unpredictable. And *then* it's recommended to explicitly call
session_gc(), and for these cases it is a great addition. But in a
typical medium or high traffic site the period is very predictable as as
such there's no way to document otherwise.

> probability-based behavior (and how to do that; based on my
> observations, the vast majority of users don't know how GC is triggered
> at all)

And that's great BTW since majority of users don't need to know that -
it just works. We shouldn't ruin that.

> - Trigger warnings when session_gc() is called while gc_probability is
> not 0.

This does not sound like a good idea to me. Why we should make it harder
for people to use it together? session_gc() has nothing to do with
gc_probability.

> - To avoid re-activating expired sessions, trigger warnings when
> session_gc() is called after session_start()

Last time I've looked at the patch, session_gc() was required to be
called after session start. See:

https://github.com/php/php-src/pull/1852/files#diff-2e4264d70a35458a2241e27f76f4a93cR20

I think this is wrong (see my comments there) and in fact we should not
expose this complexity to the user - gc() should just do the GC and hide
the technical details.
-- 
Stas Malyshev
smalyshev@gmail.com