5

CodeIgniter 2 regenerates the session id on every http-call. This leads to problems with concurrent ajax calls. This makes it possible that client and server get out of sync and the session is lost. A Fix to this is not updating the session on ajax-calls (see Codeigniter session bugging out with ajax calls). But if you use CodeIgniter as an API for a single page application, where every call is ajax, this just leads to the session never being updated at all. The user just get logged out after the session timeout (default 5 minutes).

In CodeIgniter 3 they attempted to fix this by using a write lock (see https://github.com/bcit-ci/CodeIgniter/issues/3073) on session storage. Because this relies on a Database-Feature it is only possible to safely store session information in MySQL and PostgreSQL. Redis for example can not be used (see http://www.codeigniter.com/userguide3/installation/upgrade_300.html#step-6-update-your-session-library-usage).

Finally my question is: How does Laravel handle this Problem? Laravel can use Redis for session storage. So when does laravel regenerate the session id? And if Laravel doesnt regenerate it automatically on every http request, how can this be judged in context of security aspects?

Community
  • 1
  • 1
Alex
  • 147
  • 4
  • 1
    Laravel only regenerates the session ID when you sign in and sign out. Also, in order to make any post request, you must include a CSRF token (laravel 5 forces this. laravel 4 this is optional) in your request. That helps with the security. – Patrick Stephan May 13 '15 at 15:43
  • Redis is perfectly fine to use with CI3, the note about MySQL and PostgreSQL in the upgrade instructions that you've linked refer only to the 'database' driver, which Redis is not a part of. – Narf May 13 '15 at 16:54

1 Answers1

1

Like pstephan1187 noted, "Laravel only regenerates the session ID when you sign in and sign out". CSRF Protection is used against cross-site request forgeries, and it consists of a field that is required by default (Laravel 5) in POST, PUT and DELETE requests.

Handling this in ajax-calls is outside the functionality offered by Laravel, but can be worked around pretty easily.

For more information about Laravel sessions, see the official documentation (Which, by the way, is a very nice and easy-to-understand read).

OskarD90
  • 613
  • 2
  • 8
  • 26