Add config option to disable strict session timeout to be able to use read_and_close

Fixed https://github.com/nextcloud/server/issues/29356

Signed-off-by: Julius Härtl <jus@bitgrid.net>

diff --git a/config/config.sample.php b/config/config.sample.php
index 025cf1105a01a60d2aa0c3b54c723d47838fd39b..fe45223361faa7cd650990c1e8147376bb13db67 100644 (file)
--- a/config/config.sample.php
+++ b/config/config.sample.php
@@ -256,6 +256,17 @@ $CONFIG = [
  */
 'session_lifetime' => 60 * 60 * 24,
 
+/**
+ * `true` enabled a relaxed session timeout, where the session timeout would no longer be
+ * handled by Nextcloud but by either the PHP garbage collection or the expiration of
+ * potential other session backends like redis.
+ *
+ * This may lead to sessions being available for longer than what session_lifetime uses but
+ * comes with performance benefits as sessions are no longer a locking operation for concurrent
+ * requests.
+ */
+'session_relaxed_expiry' => false,
+
 /**
  * Enable or disable session keep-alive when a user is logged in to the Web UI.
  * Enabling this sends a "heartbeat" to the server to keep it from timing out.

diff --git a/lib/base.php b/lib/base.php
index e787559c4c1706e2fe5d1fed11f4bdd62fd8be6b..c0aee6c528f3acbadf72e3dffad97415e66ed7db 100644 (file)
--- a/lib/base.php
+++ b/lib/base.php
@@ -455,7 +455,9 @@ class OC {
                        \OC::$server->getUserSession()->logout();
                }
 
-               $session->set('LAST_ACTIVITY', time());
+               if (!self::hasSessionRelaxedExpiry()) {
+                       $session->set('LAST_ACTIVITY', time());
+               }
                $session->close();
        }
 
@@ -466,6 +468,13 @@ class OC {
                return \OC::$server->getConfig()->getSystemValue('session_lifetime', 60 * 60 * 24);
        }
 
+       /**
+        * @return bool true if the session expiry should only be done by gc instead of an explicit timeout
+        */
+       public static function hasSessionRelaxedExpiry(): bool {
+               return \OC::$server->getConfig()->getSystemValue('session_relaxed_expiry', false);
+       }
+
        /**
         * Try to set some values to the required Nextcloud default
         */

diff --git a/lib/private/Session/Internal.php b/lib/private/Session/Internal.php
index f192b20cc95e3db2343306f646ab8342cc4f1f28..87dd5ed60145c8ba9ccb257cad1269af4df3cdb0 100644 (file)
--- a/lib/private/Session/Internal.php
+++ b/lib/private/Session/Internal.php
@@ -178,7 +178,7 @@ class Internal extends Session {
         */
        public function reopen(): bool {
                if ($this->sessionClosed) {
-                       $this->startSession();
+                       $this->startSession(false, false);
                        $this->sessionClosed = false;
                        return true;
                }
@@ -225,7 +225,11 @@ class Internal extends Session {
                }
        }
 
-       private function startSession(bool $silence = false) {
-               $this->invoke('session_start', [['cookie_samesite' => 'Lax']], $silence);
+       private function startSession(bool $silence = false, bool $readAndClose = true) {
+               $sessionParams = ['cookie_samesite' => 'Lax'];
+               if (\OC::hasSessionRelaxedExpiry()) {
+                       $sessionParams['read_and_close'] = $readAndClose;
+               }
+               $this->invoke('session_start', [$sessionParams], $silence);
        }
 }