On May 6, 2008, at 10:18 AM, Sean wrote:
What options exist for file-based sessions within a high traffic,
load balanced environment?
Having session state on the server side is very convenient, but
when it comes to scaling out it becomes a real pain. If you have
a site that must be able to handle a lot of traffic (pick your
number, depends a lot on your app) then the convenience of server
side session state quickly becomes a liability. For high traffic
sites I highly recommend designing it to not use server side
session state.
You loose a lot of security by having the client store the data...
I'm not suggesting that either ( I must have done bad job explaining
my position ). What I'm advocating for high traffic sites is
sticking with the shared nothing approach that HTTP provides as much
as possible. There are of course some minimal things that need to be
done via cookies, like user validation, but that list should be very,
very short and the exception, not the rule.
Keeping session state in cookies isn't really much of option for
variety of reasons (security, additional bandwidth, size limitations,
etc). Doing session state on the server side is fine for smaller
sites (will never grow beyond 1 web server), but is a pain for sites
that have to scale out to handle lots of traffic/page views. That
basic reason that it is a pain is keeping all of that data in sync
across all of the potential web servers and data centers that your
user might hit to access your site. In many respects keeping user
state in sync is much more important than keeping your application
data in sync (replication lag and such), because of the potential
security implications.
Avoiding session state for your high traffic site will make it easier
to scale and reduce the number of things that you have to keep up and
going and in (mostly) in sync. For high traffic sites they'll be
plenty of other things to keep you busy :-)
--
Joseph Scott
[EMAIL PROTECTED]
http://joseph.randomnetworks.com/
_______________________________________________
UPHPU mailing list
[email protected]
http://uphpu.org/mailman/listinfo/uphpu
IRC: #uphpu on irc.freenode.net
