possible problem with memcache's new session feature
| From: | bas at tobin dot nl | Date: | Fri, 15 Jun 2007 13:02:19 +0000 |
| Subject: | possible problem with memcache's new session feature | ||
| Groups: | php.pecl.dev | ||
| Request: | Send a blank email to pecl-dev+get-4732@lists.php.net to get a copy of this message | ||
Hi there,
I just updated to the newest memcache extension and saw a file called
memcache_session.c.
Curious as I usually am, I took a look at the code and saw an C
implementation looking a lot like my old memcache session implementation
using the session_set_save_handler in php userland code.
While this will work for most people, we've had major issues with this
kind of implementation in combination with an Ajax frontend. Since I saw
no lock on session information it is very well possible for two requests
from the same session to intervene with the session information in a
negative way.
Example:
- request one retrieves session data
- request two retrieves session data
- request two changes session vars
- request two finishes and writes session data
- request one finishes after request two and writes it's copy of the
session data (modified or original) to memcache
Effectively the session data update from request two is lost!
Is locking session key-value pairs something that is going to be
implemented? If not (or not soon) shouldn't we warn users for this
possible problem when using memcache as session storage handler?
ps. I know memcache has no native locking mechanisms but it can be
emulated (with some performance penalties) by using memcache->add.
At session_read, try an x amount of time to get a succesful
mc->add(lockkey => lockhash), failing on time out. At session_write, read
lockhash = mc->get(lockkey). If not existent or retrieved lockhash differs
from sessions lockhash, fail.
Regards,
Bas van Beek