[TYPO3-core] OT: session handling, was RFC #12130: Improve performance of flashmessages

[Bernhard Kraft]

Martin Kutschker schrieb:
> Steffen Kamper schrieb:
>> Hi Ernesto,
>>
>> Ernesto Baschny [cron IT] schrieb:
>>> I have only seen $_SESSION being used in user authentication
>>> (challenge-response) and session_start's are hidden inside some
>>> functions, so that I don't really know if we can rely that we always
>>> have a PHP session available.
>>>
>> if we can't rely on this, no login would be possible, as login_challange
>> is stored in $_SESSION
> 
> I remember that I wondered if it was a good idea to implement it like that at the time Bernard
> introduced the feature (actually a fix IMHO). But it seems that noone ever runs PHP with sessions
> disabled. So yes, IMHO, moving away from custom session handling to standard session handling is an
> option for the future.

I did not really follow your thread about those flashmessage-boxes
(which I think could be a quite good API for notification messages etc,
probably even user2user messages).

I now looked this up in the Changelog, and before my patch
login_challenge was taken from posted values, which of course did not
implement a valid challenge/response system. My patch got applied to
TYPO3 on 2005-04-01 by Kasper.

I think I did not store this challenge value using the normal TYPO3
session variable handling system, because I simply did not know about it
at this time ;)

When I got it correct, TYPO3-Session variables are simply stored by
associating database entries with the cookie which gets set anyways. And
when no cookie can be set on the client, also PHP-Sessions would not
work (PHP-Session do transparently more or less the same than using
"TSFE->fe_user->setKey()")


So chaning TYPO3 Session to really store the data in $_SESSION would be
an option - but one has to take care that PHP is/can get limited to only
a specific amount of data/bytes being stored in there. So this could be
a problem on shared-hosters, where I am not allowed not change this
php-value.


greets,
Bernhard