roidrage/redis-session-store — pull request #39 by olek (2014-04-18 20:14:48+00:00)
Title: Fix empty session proliferation

Overall theme for this pull request: delay session creation in redis until it is
actually needed.

I admit that deleting existing functionality is not going to be a popular move,
but there we go... at least hear me out...

All the extra paranoia around random number generator is really nice,
but it has one unfortunate side behavior - it creates session in redis
very early. Many rails sessions are NEVER being saved. Most simple
example - session that was requested and used to read some non-existing
values is discarded at the end of the request processing by Rack.
Another example is "request.session_options[:skip] = true". It
instructs to skip session commit altogether. Having paranoid code makes
redis perform more of write operations, and results in redis having more
garbage in it at the end of the day.

I liked 'paranoia' in generate_sid as long as the only perceived price for it was
extra complexity and some extra CPU cycles, but having all those extra
sessions needlessly created in redis seems to be too much of a price to
pay for it.

Also,
.session_exists? override was added to prevent needless new sessions
from being created in scenario where user HAS session id, but it already
expired, or is invalid for some other reason, and session was accessed
only for reading. It adds the expense of extra call to redis, but
delays (and in some cases, prevents) sessions creation.