zendframework/zf2 — pull request #3971 by Slamdunk (2013-03-06 08:02:59+00:00)
Title: SessionArrayStorage doesn't preserve _REQUEST_ACCESS_TIME

This PR **intentionally fails**, because I wrote only the test and not the solution.

Now I'll explain the issue, and why I didn't write any solution, yet.

When `SessionManager` is instantiated, immediatly a storage is built, calling its contructor. Both `SessionStorage` (extending `ArrayStorage`) and `SessionArrayStorage` (extending `AbstractSessionArrayStorage`) have in their `__construct`:
```php
$this->setRequestAccessTime(microtime(true));
```
Setting this metadata at start.

Calling `$sessionManager->start()` will also call `session_start();`, clearing all metadata in both storages, including the `_REQUEST_ACCESS_TIME`.

So why, after SessionManager start call, `SessionStorage` retains the _RAT, and `SessionArrayStorage` doesn't? Because `SessionStorage` sets the _RAT to `$this` (itself), and then SessionManager sets `$_SESSION = $storage`.

We can't take the same approach for `SessionArrayStorage`: it does not set anything to itself, so `$_SESSION = $storage` is meaningless in this case.

IMHO, the best way to resolve definitively these type of issues is to refactor at root the problem: no `StorageInterface` has to play with `$_SESSION` until `session_start` is called, but this involves a lot of code, and probably a lot of compatiblity breaks.

What are your thoughts?