Tickets :: Comment on [#1580] Horde SessionHandler drivers do not serialize session access

* Your Email Address
* Spam protection	Enter the letters below: .___..___.__ .__. __ _/ [__ \| \\| \|/ ` ./__.\| \|__/\|__\\__.
Comment	> None of the Horde Framework SessionHandler drivers address session > serialization. This is problematic because many Horde application > PHP scripts (e.g., imp/mailbox.php) generate output that includes > Javascript code that results in multiple reconnects from the browser > (to retrieve CSS files, Javascript code libraries, etc). If the > original PHP script hasn't written its session state before these > subsequent accesses occur, the session state is corrupted, due to the > lack of serialized access. This can be visualized as two interleaved > threads of execution--B starting subsequent to A, and each accessing > the same session state (x): > > > > A(t0)-->session_read(x)-->session_write(x) > > B(t0+delta)-->session_read(x)-->session_write(x) > > > > In this scenario, the PHP script represented by thread A believes > that it has committed its session state, which it has, but which is > subsequently overwritten by the (earlier) session state contained in > thread B. Therefore, the output generated by A is no longer > consistent with the session cache--resulting in "message not found" > errors, and other oddities. Proper serialization of session access > in the SessionHandler drivers would alleviate this condition. > >
Attachment
Watch this ticket