Commit b48950c1 authored by matt@zope.com's avatar matt@zope.com

Get rid of additional sessions document

parent 2a198a74
Session Administration
Overview
Session information in Zope is *persistent data* which is assocated
with both a *browser id* and a *session id*.
Functionally, session data behaves as a dictionary-like object; data
is saved and retrieved from the session object.
Sessions are tracked by two components a *browser id manager* and
a *session data manager*. Session data is then saved via a third
component, a *transient object container.*
Setup
By default, Zope will create the following components for you on startup.
You only need to create these components yourself if you wish to alter
the default configuration.
To set up sessions on a Zope system, you must add:
- A Browser ID Manager named "browser_id_manager"
- A Session Data Manager
- A Transient Object Container
To facilitate sessions on systems without ZEO, you may wish to create
a *Temporary Folder* to store your Transient Objects.
The session data manager will begin automatically adding a SESSION
object to the REQUEST in the default configuration.
Session Assignment
The browser ID manager will by default assign a cookie to each browser
which visits Zope, using the cookie name _ZopeId. The browser ID manager
keeps track of the "uniqueness" of visitors, so that sessions are not
commingled.
**Note:** Browser ID management is not cryptographically secure; the
data communicated to Zope by the browser is subject to interception or
modification without detection by Zope.
Session Data Creation
When Zope traverses a URL past a session data manager, the session
data manager has the opportunity to create and insert a SESSION object
into the REQUEST object. This is done in a lazy fashion, so that if
the application does not use the SESSION object, it will not actually
be created.
Session data is created as transient objects in a transient object
container. The transient object container will destroy its contents
after a certain period of time elapses. Transient objects act as
dictionaries; one may use the traditional dictionary methods to access
their contents.
Session Data Object Expiration
Session data objects expire after the period between their last
access and "now" exceeds the timeout value provided to the
transient object container which hold them. No special action need
be taken to expire session data objects.
It is worth noting however, that the transient object container may
not be precise about destruction of session data; i.e. session data which
is to expire after 20 minutes of inactivity may expire later than 20
minutes.
Concepts and Caveats
Mutable Data Stored Within Session Data Objects
If you mutate an object stored as a value within a session data
object, you'll need to notify the sessioning machinery that the
object has changed by calling 'set' or '__setitem__' on the
session data object with the new object value. For example::
session = context.REQUEST.SESSION
foo = {}
foo['before'] = 1
session.set('foo', foo)
# mutate the dictionary
foo['after'] = 1
# performing session.get('foo') 10 minutes from now will likely
# return a dict with only 'before' within!
You'll need to treat mutable objects immutably, instead. Here's
an example that makes the intent of the last example work by
doing so::
session = context.REQUEST.SESSION
foo = {}
foo['before'] = 1
session.set('foo', foo)
# mutate the dictionary
foo['after'] = 1
# tickle the persistence machinery
session.set('foo', foo)
An easy-to-remember rule for manipulating data objects in
session storage: always explicitly place an object back into
session storage whenever you change it. For further reference,
see the "Persistent Components" chapter of the Zope Developer's
Guide at http://www.zope.org/Documentation/ZDG.
Networking with ZEO
It is important to note that in a ZEO environment, the default Zope
configuration which includes an already established Temporary Folder and
Transient Object container will not yeild the desired results; Temporary
Folders store their data **locally** and do not store information in ZEO,
thus any session data stored in a Temporary Folder will not be
distributed to other ZEO clients.
Conflict Errors
This session tracking software stores all session state in
Zope's ZODB. The ZODB uses an optimistic concurrency strategy
to maintain transactional integrity for simultaneous writes.
This means that if two objects in the ZODB are changed at the
same time by two different connections (site visitors) that a
"ConflictError" will be raised. Zope retries requests that
raise a ConflictError at most 3 times. If your site is
extremely busy, you may notice ConflictErrors in the Zope debug
log (or they may be printed to the console from which you run
Zope). An example of one of these errors is as follows::
2001-01-16T04:26:58 INFO(0) Z2 CONFLICT Competing writes at, /getData
Traceback (innermost last):
File /zope/lib/python/ZPublisher/Publish.py, line 175, in publish
File /zope/lib/python/Zope/__init__.py, line 235, in commit
File /zope/lib/python/ZODB/Transaction.py, line 251, in commit
File /zope/lib/python/ZODB/Connection.py, line 268, in commit
ConflictError: '\000\000\000\000\000\000\002/'
Errors like this in your debug log (or console if you've not
redirected debug logging to a file) are normal to an extent. If
your site is undergoing heavy load, you can expect to see a
ConflictError perhaps every 20 to 30 seconds. The requests
which experience conflict errors will be retried automatically
by Zope, and the end user should *never* see one. Generally,
session data objects attempt to provide application-level
conflict resolution to reduce the limitations imposed by
conflict errors NOTE: to take advantage of this feature, you
must be running Zope 2.3.1 or better, and you must be using it
with a storage such as FileStorage or SessionStorage which
supports application-level conflict resolution.
Zope Versions and Sessioning
Zope Versions are not particularly useful in combination with
sessioning. Particularly, if you change the properties of a
session data manager or browser id manager while working in a
Version on a "production" site, it may cause the sessioning
machinery to stop working for unversioned visitors to the site
due to the "locking" nature of versions. To work around this
problem, do not lock any sessioning-related objects while in a
Version. Alternately, do not use Versions.
Extending The Session Tracking Product
Implementing Alternate Session Data Managers and Data Containers
Alternate session data managers and data containers (perhaps
using a SQL database as a persistence mechanism) may be
implemented if they adhere to the interfaces outlined in the
SessioningInterfaces.py documentation which ships with this
software.
See Also
- "Transient Objects":../../Transience/Help/Transience.stx
- "Temporary Folders":../../TemporaryFolder/Help/TemporaryFolder.stx
- "Session API":SessionInterfaces.py
- "Session API Programming":sessionapi-prog.stx
...@@ -102,5 +102,5 @@ Instantiating Multiple Browser Id Managers (Optional) ...@@ -102,5 +102,5 @@ Instantiating Multiple Browser Id Managers (Optional)
See Also See Also
- "Session Tracking":Sessions.stx - "Session API":SessionInterfaces.py
...@@ -55,5 +55,5 @@ Browser Id Manager - Change ...@@ -55,5 +55,5 @@ Browser Id Manager - Change
See Also See Also
- "Session Tracking":Sessions.stx - "Session API":SessionInterfaces.py
...@@ -39,5 +39,5 @@ Session Data Manager - Add ...@@ -39,5 +39,5 @@ Session Data Manager - Add
See Also See Also
- "Session Tracking":Sessions.stx - "Session API":SessionInterfaces.py
...@@ -18,5 +18,5 @@ Session Data Manager - Change ...@@ -18,5 +18,5 @@ Session Data Manager - Change
See Also See Also
- "Session Tracking":Sessions.stx - "Session API":SessionInterfaces.py
...@@ -63,6 +63,5 @@ See Also ...@@ -63,6 +63,5 @@ See Also
- "Session API":SessionInterfaces.py - "Session API":SessionInterfaces.py
- "Session Tracking":Sessions.stx
- "Transient Object API":../../Transience/Help/TransienceInterfaces.py - "Transient Object API":../../Transience/Help/TransienceInterfaces.py
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment