In 0.26, sessions are saved too late about plack-middleware-session HOT 7 CLOSED

https://gist.github.com/dakkar/5645bb54bdfa1ede08fa a small test case.

The problem does not seem to happen much with the File store, but it happen pretty reliably with the DBI store.

from plack-middleware-session.

Excellent catch. cc @alexmv

We'd either have an option to disable the behavior, or have some kind of API using special keys in $env to change the behavior in runtime - which would probably default to the before phase like we do, since updating session in the stream response sounds rarer for me.

Doing the save twice might be doable but I personally don't like it.

from plack-middleware-session.

psgix.session.options already has similar no_store which prevents updating the data for the session that doesn't need save. Can we add a new option like late_store which enables the introduced behavior, and otherwise updating before the streaming response like previously? @alexmv

from plack-middleware-session.

Hm. I entirely believe the race condition -- though I'm unable to duplicate it using the gist you showed. Is the got/expected failure supposed to occur without the ForceSessionSave middlware? Even with 10 parallel user agents and upping it to 5 redirects instead of three, I'm unable to get a mismatch.

I'll push a branch shortly which makes the late storage behavior contingent on a psgix.sesison.options flag.

from plack-middleware-session.

@dakkar, can you confirm the above branch fixes this for you?

from plack-middleware-session.

I just shipped 0.27-TRIAL with the fix.

from plack-middleware-session.

@alexmv confirmed, it works. thank you!

from plack-middleware-session.