Skip to content

[HttpFoundation] enhance PdoSessionHandler #10931

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 8 commits into from
Oct 3, 2014
Merged

[HttpFoundation] enhance PdoSessionHandler #10931

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
7dad54c
[HttpFoundation] remove base64 encoding of session data
Tobion May 17, 2014
251238d
[HttpFoundation] implement lazy connect for pdo session handler
Tobion May 18, 2014
af1bb1f
add test for null byte in session data
Tobion May 18, 2014
e79229d
[HttpFoundation] allow different lifetime per session
Tobion May 18, 2014
182a5d3
[HttpFoundation] add create table method to pdo session handler
Tobion May 18, 2014
5978fcf
added upgrade and changelog notes for PdoSessionHandler
Tobion May 25, 2014
6f5748e
adjust sqlite table definition
Tobion Jun 4, 2014
1bc6680
[HttpFoundation] implement different locking strategies for sessions
Tobion Jun 7, 2014
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 28 additions & 1 deletion UPGRADE-2.6.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
UPGRADE FROM 2.5 to 2.6
UPGRADE FROM 2.5 to 2.6
=======================

Form
Expand Down Expand Up @@ -101,3 +101,30 @@ Security
@security.token_storage => getToken()
@security.token_storage => setToken()
```

HttpFoundation
--------------

* The `PdoSessionHandler` to store sessions in a database changed significantly.
- By default, it now implements session locking to prevent loss of data by concurrent access to the same session.
- It does so using a transaction between opening and closing a session. For this reason, it's not
recommended to use the same database connection that you also use for your application logic.
Otherwise you have to make sure to access your database after the session is closed and committed.
Instead of passing an existing connection to the handler, you can now also pass a DSN string which
will be used to lazy-connect when a session is started.
- Since accessing a session now blocks when the same session is still open, it is best practice to
save the session as soon as you don't need to write to it anymore. For example, read-only AJAX
request to a session can save the session immediately after opening it to increase concurrency.
- As alternative to transactional locking you can also use advisory locks which do not require a transaction.
Additionally, you can also revert back to no locking in case you have custom logic to deal with race conditions
like an optimistic concurrency control approach. The locking strategy can be chosen by passing the corresponding
constant as `lock_mode` option, e.g. `new PdoSessionHandler($pdoOrDsn, array('lock_mode' => PdoSessionHandler::LOCK_NONE))`.
For more information please read the class documentation.
- The expected schema of the table changed.
- Session data is binary text that can contain null bytes and thus should also be saved as-is in a
binary column like BLOB. For this reason, the handler does not base64_encode the data anymore.
- A new column to store the lifetime of a session is required. This allows to have different
lifetimes per session configured via session.gc_maxlifetime ini setting.
- You would need to migrate the table manually if you want to keep session information of your users.
- You could use `PdoSessionHandler::createTable` to initialize a correctly defined table depending on
the used database vendor.
11 changes: 11 additions & 0 deletions src/Symfony/Component/HttpFoundation/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,17 @@
CHANGELOG
=========

2.6.0
-----

* PdoSessionHandler changes
- implemented different session locking strategies to prevent loss of data by concurrent access to the same session
- [BC BREAK] save session data in a binary column without base64_encode
- [BC BREAK] added lifetime column to the session table which allows to have different lifetimes for each session
- implemented lazy connections that are only opened when a session is used by either passing a dsn string
explicitly or falling back to session.save_path ini setting
- added a createTable method that initializes a correctly defined table depending on the database vendor

2.5.0
-----

Expand Down
Loading