EllisLab/CodeIgniter — pull request #1746 by dchill42 (2012-08-29 18:08:50+00:00)
Title: Session Cookie Locking

This is a follow-up to #353, where @GDmac raised the issue of concurrent requests corrupting user data stored in the session cookie or database.

The basic scenario is that a client sends a request (say, via AJAX) which will update session data. Before that request completes, another is sent which will make a different update to session data. On the server, these concurrent requests will conflict and the last request to write user data will win.

The solution proposed here is to use a temporary file based on the session id as a simple lock. The first process to lock the file gets exclusive access to that session until the end of the request. It's a poor man's mutex which should work and be accessible on all supported systems. The feature is optional and enabled by a new config directive.

I hope there will be a discussion of this idea and any alternatives. I am completely open to different ways to solve this issue.

Signed-off-by: dchill42