working with PHP session on load-balanced servers

[stndn]

(long post -- more like rants)

So the servers for the company where i worked for have decided to use a load balancer to .. well, balance the server load and keep it alive longer and better.

Everything seems to be working nicely. If people browse to http://ourcompany, they are redirected to either compi1 or compi2 transparently. Any read/write to the database is also synchronized nicely using triggers and whatever.

Now here's where the headache comes.

As the person working on the member and login information, i decided to use PHP's $_SESION.
All was nice in the beginning ...
The user log in to their account, i save the session information on the server, save the same information in database (which get sync-ed right away), and move along.

Sounds simple enough.

Except that, let's say if i'm logged in from compi1, and the next time i access our site from compi2, the user will be rejected and will be told to log in first since the $_SESSION information was only stored in compi1.

Meh.

So now i need to figure out a way such that the session information stored in compi1 is also made available on compi2. One of the ways i could think of is use both $_SESSION and $_COOKIE authentication to check for user's login. Session for server side, cookie for client site.

Another thing i tried was using ini_set ("session.cookie_domain", ".something_here.com");, but that doesn't seem to work as well.

I'm stumped.

Anyone have experience regarding doing sessions in load-balanced servers? How do you make sure the session information is shared across the different computers? Or maybe it's a simple thing to do and i'm just looking at it from too complicated point of view?

Thanks for reading ... i need more caffeine... -(

edit: i would put this in off topic, but i'm hoping that someone can shed the light and help with it.
if this post counts more towards rants than programmer's frustration with programming, feel free to move it.

 

[AFB]

Common database?
http://www.php.net/session_set_save_handler

 

[WannaFly]

AFAIK there is no "easy" way. Now, I've never worked with load-balanced, but i've done a bit of reading. The best way would be to handle sessions in a database, not sure if PHP handles this through php.ini or not - You'd probably have to write custom session handling code. Another idea would be perhaps share the session directory and tell both servers to use the same directory to store their session information - again not sure if it would work.

couple links might be helpful to you:
http://www.webdesignforums.net/showthread.php?t=16115
http://www.phpbuilder.com/columns/ying20000602.php3

 

[stndn]

thanks for the reply and link, amdfanboy.
So, if i use session_set_save_handler(), i would replace all the built-in PHP session handling stuffs (eg: $_SESSION['username'] = "joe") with one of the function calls in session_set_save_handler?

I have read the link twice, but i'm still confused. Maybe i just need to read it one more time .... -(
new stuffs take a while to penetrate to the brain.

 

[stndn]

WannaFly, yeah i know there's no easy way out for anything.
The problem with sharing the session directory will ultimately come down to security issue. I don't think the backend guy will be happy with me wanting to share the directory, but i'll try to talk to him again later.

I have written the session information to a database. I just don't know how to use custom session handler to make use of the information i stored there. I'll take a look at the links you provided me as well.

Thanks again.

 

[stndn]

After reading the php manual again, as well as reading the two links provided by WannaFly, i think i might have found a solution to the problem we're facing.
Now what's left if try to take apart the examples and put them together again to work with our database and whatever else we want to include, while making sure none of those break the authentication method we have implemented in our scripts.

:thumbsup:

 

[stndn]

oooo... found another nice reference:
http://www.zend.com/zend/spotl...code-gallery-wade8.php
quite enlightening...

should be a good reference for people starting to work with session -)

 

[stndn]

Hmmm...
is it just me, or does this custom session stuffs can only write/read one session value, instead of reading multiple session variable like PHP's build in session handler?

As in, with PHP's default, i can:
$_SESSION['username'] = "hello";
$_SESSION['password'] = "world";

while with this custom script, i can only do:
$_SESSION['username'] = "hello";

?

edit: never mind.. i figured it out. i was mistaken badly.

I missed the part where the session value is stored as "text" in the database column type. Whatever session value is specified, will be serialized and stored in the "text" column (or whatever we specified) and can be retrieved later.

Forget this post ... i'm on my way to better tomorrow -D

 

[bunker]

Question for you. When a user accesses the site, the load balancer directs them to one or the other server. When they're done doing what they're doing, isn't that the end of the session? Shouldn't they have to log back in on either server if their session is over? Maybe it's just me, but I thought that was the purpose of sessions, if you wanted a persistent logged in state shouldn't you be using cookies?

I'm just asking, I'm in no way a competent developer .

 

[AntiEverything]

I don't use PHP, but assume it's similar to other systems.

A web session is the persistence of data between pages. Data saved in memory for a session can be reused the next time. It uses a cookie to store a session ID, but the data is saved in server memory. When a page is requested, the server uses the ID to associate the user requesting a page with the data stored for a session.

 

[arcain]

Some load balancers can also do "sticky" load balancing (I think that's the terminology). Where users from one IP or whatever always hit the same server.

Though we use a session handler that saves to a database accessible by both web servers.

 

[stndn]

bunker: i don't think the session is over until either (a) the user logs out manually, or (b) the user has timed out due to inactivity. And when the session is over, yes -- they need to login again to access the restricted pages.
I can either use cookies or use sessions to keep the user's persistent connection. I prefer session, because (a) (supposedly) it's more secure than cookies, and (b) more and more people have turned off cookies due to privacy issues.
However, we might end up doing session + cookies later on, because of some additional security measure we want to add (eg: preventing session hijacking and all that).

AntiEverything: Yes, that's basically the understanding i have with regards to session. All that's stored in the browser is the session id, and the data associated with the sessions are stored in the server. By default, PHP saves the session information in a temporary session file. With the custom session handlers (from the links provided by amdfanboy and WannaFly, i can customize them to store the information in database instead.

arcain: I don't know if our load balancer can do "sticky" load balancing, but i'll ask our sysadmin about it anyway. For now, though, it seems like we'll stick with the database-driven session (or whatever it's called)