EllisLab/CodeIgniter — pull request #1900 by Areson (2012-10-17 03:52:18+00:00)
Title: Ajax Session Driver - Allow Sessions to handle simultaneous requests

This is in response to issue #154, and a rework of #1283 so that the changes are now bundled into a new session driver, tentatively called the "ajax" driver. For the sake of not having to link back, here is the overview of the changes, originally stated in #1283, with slight edits for clarity:

## Overview

This update allows sessions to work gracefully with fast/simultaneous ajax requests without needing to simply ignore updating the session. Users are allowed to have more than one valid session id at any given time, but only one is considered to be "active." The active session id is allowed to be updated (e.g. generate a new session id, set user data, etc.), but all others session IDs associated with the user are marked as "inactive" and are read-only. Inactive sessions exist solely to make sure the requests that are created near the time a session is regenerated behave properly.

To facilitate this change an additional expiration time has been added, resulting in three "timeouts" for sessions:
* Session Expiration: The point at which _any_ request is destroyed
* Time to Update: The point at which the active session id is regenerated
* Multisession Expiration: The point which an inactive session is no longer valid. Any requests made with an inactive session id after this point are destroyed.

Here is an example of a session lifetime:
* User interacts with the site for the first time, creating a new and active session, Session 1
* After the Time to Update has passed, Session 1 is "updated." This process results in a new id being generated and associated with the new active session, Session 2. Session 1 is marked as inactive.
* An AJAX request comes in with Session 1. Since it is marked as inactive, no update occurs, but the AJAX session completes because it has a valid session.
* The multisession expiration passes
* At this point, one of two final outcomes can happen:
* Another AJAX request comes in with Session 1. Since the multisession expiration has passed, the session is destroyed and the AJAX request fails due to not having a valid session. (This is possible if the multisession expiration is set too low)
* The session expiration passes for Session 1. The session will be destroyed during the course of the normal cleanup processes for sessions. Any request coming in for that session id will fail.

#### Changes from #1283/Important Notes
* This driver *requires* the use of a database to back the sessions. As such, the option to enable/disable the database has been removed as an option for this driver. It is assumed to be available and the user only needs to provided the name of the table.
* The multisession expiration (set by the option *sess_multi_expiration*) must be set sufficiently high so that any long running requests will finish before it expires. If it is set too short, dropped sessions may occur.
* #1283 required an alteration to the session table structure. The ajax driver does not require this and will work with the current session table structure.
* This driver does not provide any session locking outside what is needed to make sure that session regeneration happens properly. Simultaneous requests can still wipe out each other's data!
* The driver provides a method, called *multisession_expired* which can be used to determine if the session associated with the request is inactive and therefore read-only