Session Failures

[eluser]Ian Cook[/eluser]
Oooookay, I've got a little more concrete information now.

So it appears that when the session ID regeneration occurs, the userdata that is stored in the database table is dumped into the cookie. If this userdata is greater than 4k, the cookie no longer works ( as expected, cookies cant handle that much data ).

I tested this by doing the following...

First I changed the session id regen time to 20 seconds, for faster testing.

Then I set an additional cookie that just contained the session id. On each page load I'd compare that session id to the real session id to determine if it had changed.

If it has changed, its either because the sessiond id has been regenerated or the session has been lost entirely. So I check if my "is auth'd" variable is still present. If so, then I'll update the session id cookie copy with the new one and continue on.

If the "is auth'd" variable is not set, and the session id copy does not match the real curent session id, the session has been lost.

I filled the session userdata up with a ton of junk data. If the userdata totals less than ~4k when the session regen occurs, the session remains intact. If the userdata totals more than ~4k, the session dies after the regen occurs.

So, in summary, the session library seems to be putting a copy of all the userdata into the cookie when it regenerates the session id.

This is a bug, right?