Repository navigation
Conversation
…se sessions at once The `RANDOM_REQUESTS` cleanup strategy went over all sessions on roughly one in fifty requests. As the amount of sessions grows with traffic, this made throughput collapse under load (#2309). Random cleanups now run at most once per minute. Expired database sessions are now removed with a single query instead of one query per session. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Clients that don't send a session cookie, like API consumers, crawlers and load testing tools, got a new session persisted on every request. Besides the write itself, this made the amount of sessions grow along with traffic, which in turn made cleaning them up increasingly expensive (#2309). New sessions are now only persisted once something is stored in them. The previous URL alone doesn't count, since it is tracked on every request; `Back` falls back to the `Referer` header when it's missing. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Sessions were serialized and written to storage at the end of every request, even when nothing changed. `Session::isDirty()` now compares a fingerprint of the session's state against the one taken when it was loaded or last persisted, so values that are modified in place are still detected. File sessions that didn't change are only touched, their last activity being read from the modification time when loading. This also prevents an unchanged session from overwriting changes made by a concurrent request. Database sessions that didn't change only have their `last_active_at` updated. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The test started the server through `tempest serve`, which runs `php -S` in a child process. Stopping the command left that child running after the test suite finished. Starting the server was also slower than the time the test waits for it, so the tests were usually skipped. The server is now started directly, so it's stopped along with the process. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Benchmark ResultsComparison of Open to see the benchmark resultsNo benchmark changes above ±5%. Generated by phpbench against commit b295213 |
xHeaven
requested changes
Oct 23, 2026
| $data = $this->session->all(); | ||
|
|
||
| // The previous URL is tracked on every request, so it alone doesn't warrant persisting a new session. | ||
| unset($data[PreviousUrl::PREVIOUS_URL_SESSION_KEY]); |
Member
There was a problem hiding this comment.
This assumes that the browser sends Referer request header, though. If it sends none, this will break Back() redirects.
Same issue happens if Referrer-Policy: no-referrer is set as a response header.
This was not an issue on base, because we always saved the session.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR addresses the session-related part of #2309. Clients that don't send cookies, like load testing tools, APIs and crawlers, got a new session file on every request, skewing benchmarks.
What changed:
RANDOM_REQUESTSnow runs at most once per minute. Database cleanup uses a singleDELETEinstead of one per session.Backfalls back to theRefererheader.ClientTestleft aphp -Sserver running after the suite.