Hi,
When analyzing profiling files, I've noticed that session_start is very slow (left picture). By switching from files to redis the time spent by session_start becomes insignificant (right picture). But the drawback is that Redis doesn't have any lock capabilities (compared to files/memcached).
I've noticed that :
- An ajax query is regularly invoked to save data to session.
- There is a lot of data stored into the session.
- Data is stored into session from many places into the code, so it prevents using the good practice below:
session_start(); $_SESSION['user'] = "Me "; Session_write_close(); //close write capability
I have some questions:
- Do you consider that it is too risky to use Redis? If a race condition occurs, can the data stored into session causes a security problem ?
- Is there a way to move all the code that writes data to session in a way that only the script SaveDataToSession.php is used for this purpose?
Do you consider that it is too risky to use Redis? If a race condition occurs, can the data stored into session causes a security problem ?
I don't really know Redis and its constraints.
But I don't think it could be less secure than file storing.
I don't think that so strategic data are stored in session as to cause a security problem with incorret concurrency storing in session.
Is there a way to move all the code that writes data to session in a way that only the script SaveDataToSession.php is used for this purpose?
Well, no not in a single script.
But session values are all stored usng setSessionValue() PHP function, so possibly something can be done here.