{"action":"created","issue":{"url":"https://api.github.com/repos/silverstripe/silverstripe-hybridsessions/issues/41","repository_url":"https://api.github.com/repos/silverstripe/silverstripe-hybridsessions","labels_url":"https://api.github.com/repos/silverstripe/silverstripe-hybridsessions/issues/41/labels{/name}","comments_url":"https://api.github.com/repos/silverstripe/silverstripe-hybridsessions/issues/41/comments","events_url":"https://api.github.com/repos/silverstripe/silverstripe-hybridsessions/issues/41/events","html_url":"https://github.com/silverstripe/silverstripe-hybridsessions/issues/41","id":374820322,"node_id":"MDU6SXNzdWUzNzQ4MjAzMjI=","number":41,"title":"PHP session is always started ","user":{"login":"ichaber","id":929858,"node_id":"MDQ6VXNlcjkyOTg1OA==","avatar_url":"https://avatars1.githubusercontent.com/u/929858?v=4","gravatar_id":"","url":"https://api.github.com/users/ichaber","html_url":"https://github.com/ichaber","followers_url":"https://api.github.com/users/ichaber/followers","following_url":"https://api.github.com/users/ichaber/following{/other_user}","gists_url":"https://api.github.com/users/ichaber/gists{/gist_id}","starred_url":"https://api.github.com/users/ichaber/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ichaber/subscriptions","organizations_url":"https://api.github.com/users/ichaber/orgs","repos_url":"https://api.github.com/users/ichaber/repos","events_url":"https://api.github.com/users/ichaber/events{/privacy}","received_events_url":"https://api.github.com/users/ichaber/received_events","type":"User","site_admin":false},"labels":[{"id":699636366,"node_id":"MDU6TGFiZWw2OTk2MzYzNjY=","url":"https://api.github.com/repos/silverstripe/silverstripe-hybridsessions/labels/affects/v4","name":"affects/v4","color":"5319e7","default":false},{"id":699636369,"node_id":"MDU6TGFiZWw2OTk2MzYzNjk=","url":"https://api.github.com/repos/silverstripe/silverstripe-hybridsessions/labels/change/patch","name":"change/patch","color":"fef2c0","default":false},{"id":699636380,"node_id":"MDU6TGFiZWw2OTk2MzYzODA=","url":"https://api.github.com/repos/silverstripe/silverstripe-hybridsessions/labels/effort/medium","name":"effort/medium","color":"fef2c0","default":false},{"id":699636408,"node_id":"MDU6TGFiZWw2OTk2MzY0MDg=","url":"https://api.github.com/repos/silverstripe/silverstripe-hybridsessions/labels/impact/high","name":"impact/high","color":"eb6420","default":false},{"id":122032379,"node_id":"MDU6TGFiZWwxMjIwMzIzNzk=","url":"https://api.github.com/repos/silverstripe/silverstripe-hybridsessions/labels/type/bug","name":"type/bug","color":"d93f0b","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-10-29T00:45:16Z","updated_at":"2018-10-30T00:51:47Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"The session init in HybridSessionMiddleware for SS4 always leads to a PHP session start once a PHP session has been initialised on any other.\r\nThis is problematic, if you try to optimise the page load performance by using a CDN or a WAF (e.g. Cloudflare or Incapsula). The session cookie will essentially prevent that page from being cached.\r\n\r\nOne example I found was a home page (without the need for a session cookie) had a session cookie set after visiting a site with a form (which needs a session cookie).\r\n\r\nThe issue is caused by an interplay of session init in HybridSessionMiddleware (https://github.com/silverstripe/silverstripe-hybridsessions/blob/master/src/Control/HybridSessionMiddleware.php#L15) and the framework Session which checks if the request contains a sessionId and if so starts the (PHP) session (https://github.com/silverstripe/silverstripe-framework/blob/4/src/Control/Session.php#L222)."},"comment":{"url":"https://api.github.com/repos/silverstripe/silverstripe-hybridsessions/issues/comments/434132989","html_url":"https://github.com/silverstripe/silverstripe-hybridsessions/issues/41#issuecomment-434132989","issue_url":"https://api.github.com/repos/silverstripe/silverstripe-hybridsessions/issues/41","id":434132989,"node_id":"MDEyOklzc3VlQ29tbWVudDQzNDEzMjk4OQ==","user":{"login":"caffeineinc","id":270384,"node_id":"MDQ6VXNlcjI3MDM4NA==","avatar_url":"https://avatars3.githubusercontent.com/u/270384?v=4","gravatar_id":"","url":"https://api.github.com/users/caffeineinc","html_url":"https://github.com/caffeineinc","followers_url":"https://api.github.com/users/caffeineinc/followers","following_url":"https://api.github.com/users/caffeineinc/following{/other_user}","gists_url":"https://api.github.com/users/caffeineinc/gists{/gist_id}","starred_url":"https://api.github.com/users/caffeineinc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/caffeineinc/subscriptions","organizations_url":"https://api.github.com/users/caffeineinc/orgs","repos_url":"https://api.github.com/users/caffeineinc/repos","events_url":"https://api.github.com/users/caffeineinc/events{/privacy}","received_events_url":"https://api.github.com/users/caffeineinc/received_events","type":"User","site_admin":false},"created_at":"2018-10-30T00:51:47Z","updated_at":"2018-10-30T00:51:47Z","author_association":"NONE","body":"No the problem is more, it should only bootstrap the session, if it's either read or written too.  \r\n\r\nNow, t's lazy started, but if you send a header cookie, it should only bootstrap and init the query it if it's requested. "}}
{"actor":{"display_login":"caffeineinc"}}