php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #71162 updateTimestamp is called always when session is empty
Submitted: 2015-12-18 22:54 UTC Modified: 2017-10-24 03:06 UTC
Votes:2
Avg. Score:2.0 ± 1.0
Reproduced:0 of 0 (0.0%)
From: e2c2be7ed0f2f336 at gmail dot com Assigned: yohgaki (profile)
Status: Assigned Package: Session related
PHP Version: 7.0Git-2015-12-18 (snap) OS:
Private report: No CVE-ID: None
View Developer Edit
Anyone can comment on a bug. Have a simpler test case? Does it work for you on a different platform? Let us know!
Just going to say 'Me too!'? Don't clutter the database with that please !
Your email address:
MUST BE VALID
Solve the problem:
19 + 22 = ?
Subscribe to this entry?

 
 [2015-12-18 22:54 UTC] e2c2be7ed0f2f336 at gmail dot com 
Description:
------------
A session which remains empty always invoke the write callback instead of updateTimestamp of the session handler.

Not really a bug but behavior would be more consistent.

Test script:
---------------
https://gist.github.com/julp/4bc6acac8ef4ca51e750

Expected result:
----------------
updateTimestamp

Actual result:
--------------
write

Patches

proposal_for_bug_71162 (last revision 2015-12-18 23:05 UTC by e2c2be7ed0f2f336 at gmail dot com)

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2015-12-20 00:10 UTC] yohgaki@php.net
-Assigned To: +Assigned To: yohgaki
 [2015-12-20 00:10 UTC] yohgaki@php.net 
Current session module is designed to write empty session always. I don't think I can change to update time stamp for empty session. (Session module cannot know empty session is new one or not, currently. Session module may detect it, though. This requires yet another state management which is rather complicated already.)

Other than this, I noticed session_set_save_handler() changed the way not to accept SessionIdHandlerInterface nor SessionUpdateTimestampHandlerInterface by someone else.

Therefore, there is no way to use object version of save handler implements SessionIdHandlerInterface or SessionUpdateTimestampHandlerInterface. 

Other parts of object based user save handler implementation needs clean up also. Assign this bug to me for session module clean up in the future.
 [2015-12-20 02:42 UTC] yohgaki@php.net 
Added phpt for this.

http://git.php.net/?p=php-src.git;a=commitdiff;h=0cf7143441c74091fb7bb2979513e6b937e4866c
 [2015-12-20 02:43 UTC] yohgaki@php.net
-Summary: lazy_write never call updateTimestamp when session remains empty +Summary: updateTimestamp is called always when session is empty
 [2016-01-15 21:47 UTC] yohgaki@php.net
-Status: Assigned +Status: Analyzed
 [2016-01-15 21:47 UTC] yohgaki@php.net 
I cannot change "php" serialize handler's behavior, but you may use "php_serialize" handler. 

session.serialize_handler=php_serialize

It saves 

a:0:{}

for empty $_SESSION and timestamp would work.

So this bug could be considered as feature request for setting "php_serialize" as the default serialize handler. "php_serialize" does not have restrictions for session variables names also. It should be the default.
 [2017-10-24 03:06 UTC] kalle@php.net
-Status: Analyzed +Status: Assigned
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Mon Oct 27 21:00:02 2025 UTC