Re: Re: Session cache, lock and write

Hi Adam, On Fri, Nov 15, 2013 at 5:00 AM, Adam Harvey <aharvey@php.net> wrote: > On 14 November 2013 11:54, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote: > > I also would like to add "session deletion delay" to mitigate session > > deletion > > race condition by adding deletion time in session data. (i.e > > session_regenerate_id(true) > > may create multiple valid sessions. This can be mitigated by having this) > > > > session.deletion_delay = int (by default 0 = delete immediately. 10 for > 10 > > sec later) > > > > If there is $_SESSION['__SESSION_EXPIRE__'] and expired, new session ID > is > > created > > automatically. > > > > I would like to hear comments for this also. > > As a nitpick, I think I'd rather this was controlled by a function > than a magic $_SESSION key, at least in userland — conceptually, it's > simpler to explain to users if everything in $_SESSION is always > persisted and it never affects behaviour. > > +1 on the idea, though. Thank you for your comment. I was wandering which is better, adding new API for expire time or just add expire time magic value to $_SESSION. Adding expire time to $_SESSION, is easy and no new API is needed, but it looks bad, I agree. Adding new API is clean, but it will requires additional operations to save handlers which might slow down performance. Magic value looks bad, while it's simpler and faster. This could be vote option. Regards, -- Yasuo Ohgaki yohgaki@ohgaki.net