세션(Session Library)¶

동시성에 대한 주의 A note about concurrency¶

Unless you’re developing a website with heavy AJAX usage, you can skip this section. If you are, however, and if you’re experiencing performance issues, then this note is exactly what you’re looking for.

Sessions in previous versions of CodeIgniter didn’t implement locking, which meant that two HTTP requests using the same session could run exactly at the same time. To use a more appropriate technical term - requests were non-blocking.

However, non-blocking requests in the context of sessions also means unsafe, because modifications to session data (or session ID regeneration) in one request can interfere with the execution of a second, concurrent request. This detail was at the root of many issues and the main reason why CodeIgniter 3.0 has a completely re-written Session library.

Why are we telling you this? Because it is likely that after trying to find the reason for your performance issues, you may conclude that locking is the issue and therefore look into how to remove the locks ...

DO NOT DO THAT! Removing locks would be wrong and it will cause you more problems!

Locking is not the issue, it is a solution. Your issue is that you still have the session open, while you’ve already processed it and therefore no longer need it. So, what you need is to close the session for the current request after you no longer need it.

Long story short - call session_write_close() once you no longer need anything to do with session variables.

파일 드라이버 Files Driver¶

The ‘files’ driver uses your file system for storing session data.

It can safely be said that it works exactly like PHP’s own default session implementation, but in case this is an important detail for you, have it mind that it is in fact not the same code and it has some limitations (and advantages).

To be more specific, it doesn’t support PHP’s directory level and mode formats used in session.save_path, and it has most of the options hard-coded for safety. Instead, only absolute paths are supported for $config['sess_save_path'].

Another important thing that you should know, is to make sure that you don’t use a publicly-readable or shared directory for storing your session files. Make sure that only you have access to see the contents of your chosen sess_save_path directory. Otherwise, anybody who can do that, can also steal any of the current sessions (also known as “session fixation” attack).

On UNIX-like operating systems, this is usually achieved by setting the 0700 mode permissions on that directory via the chmod command, which allows only the directory’s owner to perform read and write operations on it. But be careful because the system user running the script is usually not your own, but something like ‘www-data’ instead, so only setting those permissions will probable break your application.

Instead, you should do something like this, depending on your environment

mkdir /<path to your application directory>/sessions/
chmod 0700 /<path to your application directory>/sessions/
chown www-data /<path to your application directory>/sessions/

데이터베이스 드라이버 Database Driver¶

The ‘database’ driver uses a relational database such as MySQL or PostgreSQL to store sessions. This is a popular choice among many users, because it allows the developer easy access to the session data within an application - it is just another table in your database.

However, there are some conditions that must be met:

• Only your 기본값 database connection (or the one that you access as $this->db from your controllers) can be used.
• You must have the Query Builder enabled.
• You can NOT use a persistent connection.
• You can NOT use a connection with the cache_on setting enabled.

In order to use the ‘database’ session driver, you must also create this table that we already mentioned and then set it as your $config['sess_save_path'] value. For example, if you would like to use ‘ci_sessions’ as your table name, you would do this:

$config['sess_driver'] = 'database';
$config['sess_save_path'] = 'ci_sessions';

And then of course, create the database table ...

For MySQL:

CREATE TABLE IF NOT EXISTS `ci_sessions` (
        `id` varchar(128) NOT NULL,
        `ip_address` varchar(45) NOT NULL,
        `timestamp` int(10) unsigned DEFAULT 0 NOT NULL,
        `data` blob NOT NULL,
        KEY `ci_sessions_timestamp` (`timestamp`)
);

For PostgreSQL:

CREATE TABLE "ci_sessions" (
        "id" varchar(128) NOT NULL,
        "ip_address" varchar(45) NOT NULL,
        "timestamp" bigint DEFAULT 0 NOT NULL,
        "data" text DEFAULT '' NOT NULL
);

CREATE INDEX "ci_sessions_timestamp" ON "ci_sessions" ("timestamp");

You will also need to add a PRIMARY KEY depending on your ‘sess_match_ip’ setting. The examples below work both on MySQL and PostgreSQL:

// When sess_match_ip = TRUE
ALTER TABLE ci_sessions ADD PRIMARY KEY (id, ip_address);

// When sess_match_ip = FALSE
ALTER TABLE ci_sessions ADD PRIMARY KEY (id);

// To drop a previously created primary key (use when changing the setting)
ALTER TABLE ci_sessions DROP PRIMARY KEY;

레디스 드라이버 Redis Driver¶

Redis is a storage engine typically used for caching and popular because of its high performance, which is also probably your reason to use the ‘redis’ session driver.

The downside is that it is not as ubiquitous as relational databases and requires the phpredis PHP extension to be installed on your system, and that one doesn’t come bundled with PHP. Chances are, you’re only be using the ‘redis’ driver only if you’re already both familiar with Redis and using it for other purposes.

Just as with the ‘files’ and ‘database’ drivers, you must also configure the storage location for your sessions via the $config['sess_save_path'] setting. The format here is a bit different and complicated at the same time. It is best explained by the phpredis extension’s README file, so we’ll simply link you to it:

https://github.com/phpredis/phpredis#php-session-handler

For the most common case however, a simple host:port pair should be sufficient:

$config['sess_driver'] = 'redis';
$config['sess_save_path'] = 'tcp://localhost:6379';

멤캐시 드라이버 Memcached Driver¶

The ‘memcached’ driver is very similar to the ‘redis’ one in all of its properties, except perhaps for availability, because PHP’s Memcached extension is distributed via PECL and some Linux distrubutions make it available as an easy to install package.

Other than that, and without any intentional bias towards Redis, there’s not much different to be said about Memcached - it is also a popular product that is usually used for caching and famed for its speed.

However, it is worth noting that the only guarantee given by Memcached is that setting value X to expire after Y seconds will result in it being deleted after Y seconds have passed (but not necessarily that it won’t expire earlier than that time). This happens very rarely, but should be considered as it may result in loss of sessions.

The $config['sess_save_path'] format is fairly straightforward here, being just a host:port pair:

$config['sess_driver'] = 'memcached';
$config['sess_save_path'] = 'localhost:11211';

// localhost will be given higher priority (5) here,
// compared to 192.0.2.1 with a weight of 1.
$config['sess_save_path'] = 'localhost:11211:5,192.0.2.1:11211:1';

커스텀 드라이버 Custom Drivers¶

You may also create your own, custom session drivers. However, have it in mind that this is typically not an easy task, as it takes a lot of knowledge to do it properly.

You need to know not only how sessions work in general, but also how they work specifically in PHP, how the underlying storage mechanism works, how to handle concurrency, avoid deadlocks (but NOT through lack of locks) and last but not least - how to handle the potential security issues, which is far from trivial.

Long story short - if you don’t know how to do that already in raw PHP, you shouldn’t be trying to do it within CodeIgniter either. You’ve been warned.

If you only want to add some extra functionality to your sessions, just extend the base Session class, which is a lot more easier. Read the 라이브러리 생성 article to learn how to do that.

Now, to the point - there are three general rules that you must follow when creating a session driver for CodeIgniter:

• Put your driver’s file under application/libraries/Session/drivers/ and follow the naming conventions used by the Session class.

  For example, if you were to create a ‘dummy’ driver, you would have a Session_dummy_driver class name, that is declared in application/libraries/Session/drivers/Session_dummy_driver.php.

• Extend the CI_Session_driver class.

  This is just a basic class with a few internal helper methods. It is also extendable like any other library, if you really need to do that, but we are not going to explain how ... if you’re familiar with how class extensions/overrides work in CI, then you already know how to do it. If not, well, you shouldn’t be doing it in the first place.

• Implement the SessionHandlerInterface interface.

  Note

  You may notice that SessionHandlerInterface is provided by PHP since version 5.4.0. CodeIgniter will automatically declare the same interface if you’re running an older PHP version.

  The link will explain why and how.

So, based on our ‘dummy’ driver example above, you’d end up with something like this:

// application/libraries/Session/drivers/Session_dummy_driver.php:

class CI_Session_dummy_driver extends CI_Session_driver implements SessionHandlerInterface
{

        public function __construct(&$params)
        {
                // DO NOT forget this
                parent::__construct($params);

                // Configuration & other initializations
        }

        public function open($save_path, $name)
        {
                // Initialize storage mechanism (connection)
        }

        public function read($session_id)
        {
                // Read session data (if exists), acquire locks
        }

        public function write($session_id, $session_data)
        {
                // Create / update session data (it might not exist!)
        }

        public function close()
        {
                // Free locks, close connections / streams / etc.
        }

        public function destroy($session_id)
        {
                // Call close() method & destroy data for current session (order may differ)
        }

        public function gc($maxlifetime)
        {
                // Erase data for expired sessions
        }

}

모든 것을 훌륭하게 하였다면, 이제sess_driver 환경 값을 ‘dummy’ 로 하실 수가 있습니다. 그리고 여러분만의 드라이버를 사용할 수 있습니다. 축하합니다!