[TYPO3-core] OT: session handling, was RFC #12130: Improve performance of flashmessages

[Martin Kutschker]

Steffen Kamper schrieb:
> Hi Ernesto,
> 
> Ernesto Baschny [cron IT] schrieb:
>>
>> I have only seen $_SESSION being used in user authentication
>> (challenge-response) and session_start's are hidden inside some
>> functions, so that I don't really know if we can rely that we always
>> have a PHP session available.
>>
> 
> if we can't rely on this, no login would be possible, as login_challange
> is stored in $_SESSION

I remember that I wondered if it was a good idea to implement it like that at the time Bernard
introduced the feature (actually a fix IMHO). But it seems that noone ever runs PHP with sessions
disabled. So yes, IMHO, moving away from custom session handling to standard session handling is an
option for the future.

For a single-server setup PHP sessions are enough. In a multi-server setup DB (current solution) or
memcached sessions (new feature) are two possible options. Maybe a disk-based apporach with
serialized objects like PHP does is an option when you have a shared (network) file system.

But this must be postponed to 4.4.

Masi