[TYPO3-dev] Problem with RSAAuth extension

[Helmut Hummel]

Hi,

Dmitry Dulepov wrote:

> Zach Davis wrote:
>> I really think an easy fix for the problem is to call session_start() in
>> index_ts.php

Doing so has serious performance implications, as session_start() sends 
headers preventing browsers from caching the site. Additionally when 
starting the session, php locks this request, preventing other 
concurrent requests from being processed to avoid race conditions when 
manipulating session data.

Thus a PHP session should only be started if it is really needed. And 
should be closed after it.

> +1. As to the below mentioned bug report, there is a simple workaround:
>
> $_SESSION['myObj'] = serialize($myObj);
>
> And than unserialize manually.

So we accept this breaking change and the preformance problems instead 
of fixing the session check properly in rsaauth? [1]

> Many features in TYPO3

Name one which is needed in the frontend (except the Timetrack stuff, 
which IMHO should be solved differently)[2]

> and extensions rely on session.

If extensions need a php session, they should start it.

> I would be happy
> if people do not have to check for the session in every possible place
> but simply rely on TYPO3 having it started automatically.
>
> Life should be easier, not more difficult.

I totally agree that TYPO3 needs a proper implementation for PHP session 
handling which extensions (and of course the core itself) can use. I 
started to work on such a thing, but did not have the time to finish it yet.

Still even with such a solution it would be bad to start a PHP session 
just because it might be needed.


Kind regards,
Helmut

[1]https://review.typo3.org/#change,5314
[2]http://forge.typo3.org/issues/30269

-- 
Helmut Hummel
TYPO3 Security Team Leader, TYPO3 v4 Core Team Member

TYPO3 .... inspiring people to share!
Get involved: typo3.org