Difference between revisions for Users / Eo Ny




← Previous edit
Revision 6 as of 05/21/2026 16:13 ▼
8 07/16/2026 09:36 WikiAdmin 7 07/16/2026 09:36 WikiAdmin 6 05/21/2026 16:13 WikiAdmin 5 05/19/2026 11:04 WikiAdmin 4 05/05/2026 18:48 EoNy 3 05/05/2026 18:39 EoNy 2 05/05/2026 18:36 EoNy 1 05/05/2026 16:15 EoNy [neues Benutzerkonto]

(49.9 KiB)
WikiAdmin
 Next edit →
Revision 9 as of 07/16/2026 09:37 ▼
10 07/16/2026 09:38 WikiAdmin 9 07/16/2026 09:37 WikiAdmin 8 07/16/2026 09:36 WikiAdmin 7 07/16/2026 09:36 WikiAdmin

(50.0 KiB) +39
WikiAdmin

Version1 Version2 Differences
1713 1713
1714 1714 === Performance Considerations ===
1715 1715
1716   ==== Optimization Tips ====
  1716 ====Optimization Tips====
1717 1717   1. **Minimize Session Writes:**
1718     - Session data only written during ##write_close()## or regeneration
1719     - No unnecessary serialization during reads
  1718     - Session data only written during ##write_close()## or regeneration
  1719     - No unnecessary serialization during reads
1720 1720   2. **Garbage Collection:**
1721     - Probabilistic GC (based on ##cf_gc_probability##)
1722     - Only runs on ~2% of requests by default
1723     - Customize based on your session volume
  1721     - Probabilistic GC (based on ##cf_gc_probability##)
  1722     - Only runs on ~2% of requests by default
  1723     - Customize based on your session volume
1724 1724   3. **Nonce Cleanup:**
1725     - Expired nonces automatically removed on verification
1726     - Verified nonces removed from storage
1727     - No manual cleanup needed
  1725     - Expired nonces automatically removed on verification
  1726     - Verified nonces removed from storage
  1727     - No manual cleanup needed
1728 1728   4. **Session ID Validation:**
1729     - Regex-based validation is fast
1730     - No database lookup needed
  1729     - Regex-based validation is fast
  1730     - No database lookup needed
1731 1731   5. **Caching Strategy:**
1732     - Cache expensive lookups between session operations
1733     - Session data loaded once per request
  1732     - Cache expensive lookups between session operations
  1733     - Session data loaded once per request
1734 1734
1735 1735 ==== Benchmarks ====
1736 1736
… … …
1807 1807
1808 1808 ----
1809 1809
1810   === TODO Items (From Code Comments) ===
1811  
  1810 ===TODO Items (From Code Comments)===
1812 1811 The following improvements are planned:
1813 1812   1. **Do not store session ID in filename or DB index - store hash instead**
1814     - Improves security by not exposing IDs in storage layer
1815     - Would require hashing logic in store_* methods
  1813     - Improves security by not exposing IDs in storage layer
  1814     - Would require hashing logic in store_* methods
1816 1815   2. **Log of IP changes and other possible security alerts**
1817     - Track ##sticky__ip## changes more comprehensively
1818     - Create security audit trail
  1816     - Track ##sticky__ip## changes more comprehensively
  1817     - Create security audit trail
1819 1818   3. **Allocate internal unique session which lives through lifetime of uber-session**
1820     - Multi-session management (parent/child sessions)
1821     - Useful for complex user flows
  1819     - Multi-session management (parent/child sessions)
  1820     - Useful for complex user flows
1822 1821   4. **Do not delete old sessions, but use them as hijack pointers**
1823     - Maintain session history for analysis
1824     - Detect potential session hijacking patterns
1825     - Implement session relationship tracking
  1822     - Maintain session history for analysis
  1823     - Detect potential session hijacking patterns
  1824     - Implement session relationship tracking
1826 1825   5. **All SIDs used later than ~5secs of regenerations is hijacks**
1827     - Detect and block delayed session ID usage
1828     - Current implementation allows 5-second window
1829     - Could be more granular
  1826     - Detect and block delayed session ID usage
  1827     - Current implementation allows 5-second window
  1828     - Could be more granular
1830 1829
1831 1830 ----
1832 1831
… … …
1853 1852
1854 1853 ----
1855 1854
1856   === Version History ===
  1855 ===Version History===
1857 1856   - **Current**: Abstract session class with security features
1858 1857   - **Planned**: Implementation of TODO items above
1859 1858
1860 1859 ----
1861     *Documentation generated: 2026-05-05*
1862     *For latest updates, see: https://github.com/Trojer/wackowiki/blob/main/docs/SESSION_DOCUMENTATION.md*
  1860 **Documentation generated: 2026-05-05**
  1861 **For latest updates, see: https://github.com/Trojer/wackowiki/blob/main/docs/SESSION_DOCUMENTATION.md**