You are viewing a plain text version of this content. The canonical link for it is here.
Posted to zeta-issues@incubator.apache.org by "Philipp Kamps (JIRA)" <ji...@apache.org> on 2011/05/11 15:47:47 UTC
[jira] [Created] (ZETACOMP-81) Session timeout
Session timeout
---------------
Key: ZETACOMP-81
URL: https://issues.apache.org/jira/browse/ZETACOMP-81
Project: Zeta Components
Issue Type: Bug
Components: Authentication
Reporter: Philipp Kamps
Not sure, but looks like the session timeout is strange. I have following code:
$options = new ezcAuthenticationSessionOptions();
$options->validity = 10;
$session = new ezcAuthenticationSession( $options );
I would expect a session timeout after 10 seconds __OF INACTIVITY__. But it looks like it's a total lifetime of 10 seconds, even when I'm active ( constantly requesting more pages that start the session ).
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (ZETACOMP-81) Session timeout
Posted by "Philipp Kamps (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/ZETACOMP-81?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Philipp Kamps updated ZETACOMP-81:
----------------------------------
Attachment: patch.txt
I added another timestamp to $_SESSION. It gets updated when IsValid gets called.
It's still a bit confusing because (to me) it's not obvious that you need to call "isValid" in order to update the activity timestamp.
> Session timeout
> ---------------
>
> Key: ZETACOMP-81
> URL: https://issues.apache.org/jira/browse/ZETACOMP-81
> Project: Zeta Components
> Issue Type: Bug
> Components: Authentication
> Reporter: Philipp Kamps
> Attachments: patch.txt
>
>
> Not sure, but looks like the session timeout is strange. I have following code:
> $options = new ezcAuthenticationSessionOptions();
> $options->validity = 10;
> $session = new ezcAuthenticationSession( $options );
> I would expect a session timeout after 10 seconds __OF INACTIVITY__. But it looks like it's a total lifetime of 10 seconds, even when I'm active ( constantly requesting more pages that start the session ).
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (ZETACOMP-81) Session timeout
Posted by "jiraposter@reviews.apache.org (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/ZETACOMP-81?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13049741#comment-13049741 ]
jiraposter@reviews.apache.org commented on ZETACOMP-81:
-------------------------------------------------------
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/783/#review844
-----------------------------------------------------------
trunk/Authentication/src/session/authentication_session.php
<https://reviews.apache.org/r/783/#comment1827>
why not use a local variable for that ? would it make the code more readable and easier to debug ?
- james
On 2011-05-25 08:23:39, Jérôme Renard wrote:
bq.
bq. -----------------------------------------------------------
bq. This is an automatically generated e-mail. To reply, visit:
bq. https://reviews.apache.org/r/783/
bq. -----------------------------------------------------------
bq.
bq. (Updated 2011-05-25 08:23:39)
bq.
bq.
bq. Review request for zetacomponents.
bq.
bq.
bq. Summary
bq. -------
bq.
bq. Added a new ezcAuthenticationSessionOptions::idleTimeOut option to handle user's inactivity.
bq.
bq.
bq. This addresses bug ZETACOMP-81.
bq. https://issues.apache.org/jira/browse/ZETACOMP-81
bq.
bq.
bq. Diffs
bq. -----
bq.
bq. trunk/Authentication/src/options/session_options.php 1125639
bq. trunk/Authentication/src/session/authentication_session.php 1125639
bq. trunk/Authentication/tests/session/session_test.php 1125639
bq.
bq. Diff: https://reviews.apache.org/r/783/diff
bq.
bq.
bq. Testing
bq. -------
bq.
bq. Added two new unit tests :
bq. - ezcAuthenticationSessionTest::testSessionIsValidIdleTimeout()
bq. - ezcAuthenticationSessionTest::testSessionIsValidIdleTimeoutExpired()
bq.
bq. php ./UnitTest/src/runtests.php --filter=ezcAuthenticationSessionTest --verbose Authentication
bq. PHPUnit 3.5.10 by Sebastian Bergmann.
bq.
bq. Zeta Components:
bq.
bq. Authentication:
bq. ezcAuthenticationGeneralTest:
bq. ezcAuthenticationSessionTest: ............
bq. [...]
bq.
bq.
bq. Thanks,
bq.
bq. Jérôme
bq.
bq.
> Session timeout
> ---------------
>
> Key: ZETACOMP-81
> URL: https://issues.apache.org/jira/browse/ZETACOMP-81
> Project: Zeta Components
> Issue Type: Bug
> Components: Authentication
> Reporter: Philipp Kamps
> Attachments: patch.txt
>
>
> Not sure, but looks like the session timeout is strange. I have following code:
> $options = new ezcAuthenticationSessionOptions();
> $options->validity = 10;
> $session = new ezcAuthenticationSession( $options );
> I would expect a session timeout after 10 seconds __OF INACTIVITY__. But it looks like it's a total lifetime of 10 seconds, even when I'm active ( constantly requesting more pages that start the session ).
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (ZETACOMP-81) Session timeout
Posted by "Philipp Kamps (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/ZETACOMP-81?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13035063#comment-13035063 ]
Philipp Kamps commented on ZETACOMP-81:
---------------------------------------
I'm OK if isValid is updating the activity timestamp.
In general (even without the patch), I just wasn't aware that you should call isValid on each page load (because that method actually destroys the session when invalid).
isValid is also starting the session - so I don't think you'd need to call $session->start() (as the example states).
Anyways, I think we're good. Just took me some time to understand the session handling.
> Session timeout
> ---------------
>
> Key: ZETACOMP-81
> URL: https://issues.apache.org/jira/browse/ZETACOMP-81
> Project: Zeta Components
> Issue Type: Bug
> Components: Authentication
> Reporter: Philipp Kamps
> Attachments: patch.txt
>
>
> Not sure, but looks like the session timeout is strange. I have following code:
> $options = new ezcAuthenticationSessionOptions();
> $options->validity = 10;
> $session = new ezcAuthenticationSession( $options );
> I would expect a session timeout after 10 seconds __OF INACTIVITY__. But it looks like it's a total lifetime of 10 seconds, even when I'm active ( constantly requesting more pages that start the session ).
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (ZETACOMP-81) Session timeout
Posted by "jiraposter@reviews.apache.org (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/ZETACOMP-81?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13050218#comment-13050218 ]
jiraposter@reviews.apache.org commented on ZETACOMP-81:
-------------------------------------------------------
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/783/
-----------------------------------------------------------
(Updated 2011-06-16 05:06:02.239400)
Review request for zetacomponents.
Changes
-------
Stopped using time() and used $_SERVER["REQUEST_TIME"] as we do not actually need time().
Stored it in a local variable for more readability as proposed James.
Summary
-------
Added a new ezcAuthenticationSessionOptions::idleTimeOut option to handle user's inactivity.
This addresses bug ZETACOMP-81.
https://issues.apache.org/jira/browse/ZETACOMP-81
Diffs (updated)
-----
trunk/Authentication/src/options/session_options.php 1136288
trunk/Authentication/src/session/authentication_session.php 1136288
trunk/Authentication/tests/session/session_test.php 1136288
Diff: https://reviews.apache.org/r/783/diff
Testing
-------
Added two new unit tests :
- ezcAuthenticationSessionTest::testSessionIsValidIdleTimeout()
- ezcAuthenticationSessionTest::testSessionIsValidIdleTimeoutExpired()
php ./UnitTest/src/runtests.php --filter=ezcAuthenticationSessionTest --verbose Authentication
PHPUnit 3.5.10 by Sebastian Bergmann.
Zeta Components:
Authentication:
ezcAuthenticationGeneralTest:
ezcAuthenticationSessionTest: ............
[...]
Thanks,
Jérôme
> Session timeout
> ---------------
>
> Key: ZETACOMP-81
> URL: https://issues.apache.org/jira/browse/ZETACOMP-81
> Project: Zeta Components
> Issue Type: Bug
> Components: Authentication
> Reporter: Philipp Kamps
> Attachments: patch.txt
>
>
> Not sure, but looks like the session timeout is strange. I have following code:
> $options = new ezcAuthenticationSessionOptions();
> $options->validity = 10;
> $session = new ezcAuthenticationSession( $options );
> I would expect a session timeout after 10 seconds __OF INACTIVITY__. But it looks like it's a total lifetime of 10 seconds, even when I'm active ( constantly requesting more pages that start the session ).
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (ZETACOMP-81) Session timeout
Posted by "Jérôme Renard (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/ZETACOMP-81?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13033462#comment-13033462 ]
Jérôme Renard commented on ZETACOMP-81:
---------------------------------------
Hi Philipp,
Here is what I propose :
we could add an ezcAuthenticationSessionOptions::idleTimeout attribute that would be used to handle user inactivity.
This could be used in conjunction with ezcAuthenticationSessionOptions::validity in the following way.
ezcAuthenticationSessionOptions::validity handles the global timeout for the session, but if ezcAuthenticationSessionOptions::idleTimeout is isset (and inferior to ezcAuthenticationSessionOptions::validity) then the system will handle that attribute as well.
As an example here is how you could configure the session :
validity : 1 hour
idleTimeout : 10 minutes
You would get
$options = new ezcAuthenticationSessionOptions();
$options->validity = 3600;
$option->idleTimeout = 600;
That way is the user is inactive for more than 10 minutes, his session is removed, if not his session is removed after 1h anyway.
What do you think ?
> Session timeout
> ---------------
>
> Key: ZETACOMP-81
> URL: https://issues.apache.org/jira/browse/ZETACOMP-81
> Project: Zeta Components
> Issue Type: Bug
> Components: Authentication
> Reporter: Philipp Kamps
>
> Not sure, but looks like the session timeout is strange. I have following code:
> $options = new ezcAuthenticationSessionOptions();
> $options->validity = 10;
> $session = new ezcAuthenticationSession( $options );
> I would expect a session timeout after 10 seconds __OF INACTIVITY__. But it looks like it's a total lifetime of 10 seconds, even when I'm active ( constantly requesting more pages that start the session ).
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (ZETACOMP-81) Session timeout
Posted by "Jérôme Renard (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/ZETACOMP-81?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13033640#comment-13033640 ]
Jérôme Renard commented on ZETACOMP-81:
---------------------------------------
Feel free to attach a patch and I will review it :)
> Session timeout
> ---------------
>
> Key: ZETACOMP-81
> URL: https://issues.apache.org/jira/browse/ZETACOMP-81
> Project: Zeta Components
> Issue Type: Bug
> Components: Authentication
> Reporter: Philipp Kamps
>
> Not sure, but looks like the session timeout is strange. I have following code:
> $options = new ezcAuthenticationSessionOptions();
> $options->validity = 10;
> $session = new ezcAuthenticationSession( $options );
> I would expect a session timeout after 10 seconds __OF INACTIVITY__. But it looks like it's a total lifetime of 10 seconds, even when I'm active ( constantly requesting more pages that start the session ).
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (ZETACOMP-81) Session timeout
Posted by "Jérôme Renard (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/ZETACOMP-81?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13034921#comment-13034921 ]
Jérôme Renard commented on ZETACOMP-81:
---------------------------------------
I see your point, but the example in ezcAuthenticationSession::isValid() [1] shows that you must call isValid() first.
I am afraid that updating the activity timestamp would break BC if not called by isValid(). Unless I am overlooking something.
What do you think ?
1. http://incubator.apache.org/zetacomponents/documentation/trunk/Authentication/phpdoc/ezcAuthenticationSession.html#isValid
> Session timeout
> ---------------
>
> Key: ZETACOMP-81
> URL: https://issues.apache.org/jira/browse/ZETACOMP-81
> Project: Zeta Components
> Issue Type: Bug
> Components: Authentication
> Reporter: Philipp Kamps
> Attachments: patch.txt
>
>
> Not sure, but looks like the session timeout is strange. I have following code:
> $options = new ezcAuthenticationSessionOptions();
> $options->validity = 10;
> $session = new ezcAuthenticationSession( $options );
> I would expect a session timeout after 10 seconds __OF INACTIVITY__. But it looks like it's a total lifetime of 10 seconds, even when I'm active ( constantly requesting more pages that start the session ).
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (ZETACOMP-81) Session timeout
Posted by "Philipp Kamps (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/ZETACOMP-81?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13033568#comment-13033568 ]
Philipp Kamps commented on ZETACOMP-81:
---------------------------------------
I like, I like.
If that's the way you'd like to fix it, I might be able to come up with a patch.
> Session timeout
> ---------------
>
> Key: ZETACOMP-81
> URL: https://issues.apache.org/jira/browse/ZETACOMP-81
> Project: Zeta Components
> Issue Type: Bug
> Components: Authentication
> Reporter: Philipp Kamps
>
> Not sure, but looks like the session timeout is strange. I have following code:
> $options = new ezcAuthenticationSessionOptions();
> $options->validity = 10;
> $session = new ezcAuthenticationSession( $options );
> I would expect a session timeout after 10 seconds __OF INACTIVITY__. But it looks like it's a total lifetime of 10 seconds, even when I'm active ( constantly requesting more pages that start the session ).
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (ZETACOMP-81) Session timeout
Posted by "jiraposter@reviews.apache.org (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/ZETACOMP-81?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13039024#comment-13039024 ]
jiraposter@reviews.apache.org commented on ZETACOMP-81:
-------------------------------------------------------
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/783/
-----------------------------------------------------------
Review request for zetacomponents.
Summary
-------
Added a new ezcAuthenticationSessionOptions::idleTimeOut option to handle user's inactivity.
This addresses bug ZETACOMP-81.
https://issues.apache.org/jira/browse/ZETACOMP-81
Diffs
-----
trunk/Authentication/src/options/session_options.php 1125639
trunk/Authentication/src/session/authentication_session.php 1125639
trunk/Authentication/tests/session/session_test.php 1125639
Diff: https://reviews.apache.org/r/783/diff
Testing
-------
Added two new unit tests :
- ezcAuthenticationSessionTest::testSessionIsValidIdleTimeout()
- ezcAuthenticationSessionTest::testSessionIsValidIdleTimeoutExpired()
php ./UnitTest/src/runtests.php --filter=ezcAuthenticationSessionTest --verbose Authentication
PHPUnit 3.5.10 by Sebastian Bergmann.
Zeta Components:
Authentication:
ezcAuthenticationGeneralTest:
ezcAuthenticationSessionTest: ............
[...]
Thanks,
Jérôme
> Session timeout
> ---------------
>
> Key: ZETACOMP-81
> URL: https://issues.apache.org/jira/browse/ZETACOMP-81
> Project: Zeta Components
> Issue Type: Bug
> Components: Authentication
> Reporter: Philipp Kamps
> Attachments: patch.txt
>
>
> Not sure, but looks like the session timeout is strange. I have following code:
> $options = new ezcAuthenticationSessionOptions();
> $options->validity = 10;
> $session = new ezcAuthenticationSession( $options );
> I would expect a session timeout after 10 seconds __OF INACTIVITY__. But it looks like it's a total lifetime of 10 seconds, even when I'm active ( constantly requesting more pages that start the session ).
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (ZETACOMP-81) Session timeout
Posted by "jiraposter@reviews.apache.org (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/ZETACOMP-81?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13050217#comment-13050217 ]
jiraposter@reviews.apache.org commented on ZETACOMP-81:
-------------------------------------------------------
bq. On 2011-06-15 12:11:33, james pic wrote:
bq. > trunk/Authentication/src/session/authentication_session.php, line 136
bq. > <https://reviews.apache.org/r/783/diff/1/?file=19578#file19578line136>
bq. >
bq. > why not use a local variable for that ? would it make the code more readable and easier to debug ?
A local variable for time() ? If yes, then you are right, I will fix this.
- Jérôme
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/783/#review844
-----------------------------------------------------------
On 2011-05-25 08:23:39, Jérôme Renard wrote:
bq.
bq. -----------------------------------------------------------
bq. This is an automatically generated e-mail. To reply, visit:
bq. https://reviews.apache.org/r/783/
bq. -----------------------------------------------------------
bq.
bq. (Updated 2011-05-25 08:23:39)
bq.
bq.
bq. Review request for zetacomponents.
bq.
bq.
bq. Summary
bq. -------
bq.
bq. Added a new ezcAuthenticationSessionOptions::idleTimeOut option to handle user's inactivity.
bq.
bq.
bq. This addresses bug ZETACOMP-81.
bq. https://issues.apache.org/jira/browse/ZETACOMP-81
bq.
bq.
bq. Diffs
bq. -----
bq.
bq. trunk/Authentication/src/options/session_options.php 1125639
bq. trunk/Authentication/src/session/authentication_session.php 1125639
bq. trunk/Authentication/tests/session/session_test.php 1125639
bq.
bq. Diff: https://reviews.apache.org/r/783/diff
bq.
bq.
bq. Testing
bq. -------
bq.
bq. Added two new unit tests :
bq. - ezcAuthenticationSessionTest::testSessionIsValidIdleTimeout()
bq. - ezcAuthenticationSessionTest::testSessionIsValidIdleTimeoutExpired()
bq.
bq. php ./UnitTest/src/runtests.php --filter=ezcAuthenticationSessionTest --verbose Authentication
bq. PHPUnit 3.5.10 by Sebastian Bergmann.
bq.
bq. Zeta Components:
bq.
bq. Authentication:
bq. ezcAuthenticationGeneralTest:
bq. ezcAuthenticationSessionTest: ............
bq. [...]
bq.
bq.
bq. Thanks,
bq.
bq. Jérôme
bq.
bq.
> Session timeout
> ---------------
>
> Key: ZETACOMP-81
> URL: https://issues.apache.org/jira/browse/ZETACOMP-81
> Project: Zeta Components
> Issue Type: Bug
> Components: Authentication
> Reporter: Philipp Kamps
> Attachments: patch.txt
>
>
> Not sure, but looks like the session timeout is strange. I have following code:
> $options = new ezcAuthenticationSessionOptions();
> $options->validity = 10;
> $session = new ezcAuthenticationSession( $options );
> I would expect a session timeout after 10 seconds __OF INACTIVITY__. But it looks like it's a total lifetime of 10 seconds, even when I'm active ( constantly requesting more pages that start the session ).
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Closed] (ZETACOMP-81) Session timeout
Posted by "Jérôme Renard (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/ZETACOMP-81?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Jérôme Renard closed ZETACOMP-81.
---------------------------------
Resolution: Fixed
Assignee: Jérôme Renard
Fixed in rev. 1145100
> Session timeout
> ---------------
>
> Key: ZETACOMP-81
> URL: https://issues.apache.org/jira/browse/ZETACOMP-81
> Project: Zeta Components
> Issue Type: Bug
> Components: Authentication
> Reporter: Philipp Kamps
> Assignee: Jérôme Renard
> Attachments: patch.txt
>
>
> Not sure, but looks like the session timeout is strange. I have following code:
> $options = new ezcAuthenticationSessionOptions();
> $options->validity = 10;
> $session = new ezcAuthenticationSession( $options );
> I would expect a session timeout after 10 seconds __OF INACTIVITY__. But it looks like it's a total lifetime of 10 seconds, even when I'm active ( constantly requesting more pages that start the session ).
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira