Server: Session handling: api and webdav requests shall not start a session

[martinlanger90]

Steps to reproduce

1. Use NextCloud with macOS Calendar
2. do find phptmp/* | wc -l
3. get: 3825 -> more than 3800 session files in about 1-2 weeks

Expected behaviour

For WebDav connections there should be no session file generated.

Actual behaviour

for every webdav connection there is a session file

For the rest, take a look at:
https://github.com/owncloud/core/issues/29779

and the old one:
https://github.com/owncloud/core/issues/5383

and last but not least, be faster as the oc-team. nah just kidding, merry christmas and a happy new year :-)

[martinlanger90]

shouldn't this behaviour considered as a bug because the system get's full of a ton of session files? 😄

[martinlanger90]

Is there any progress on this issue?
I have to clear my phptmp folder every day, because after 2 minutes I have about 17 files generated. For an experienced coder this should not be hard to get this fixed? As this issue has the papercut label it must be easy for anyone whos contributing to NC

[martinlanger90]

I really don't want to bother someone, but "stale" on this issue? really?
1400 files per day is really a point.

[martinlanger90]

on papercut label, but not fixed since 2 years. very annoying bug.
again 12000 files in phptmp directory.

[kesselb]

I think "papercut" is not appropriate ;) It's probably only moving two lines of code around but a lot of code is build with the assumption that a session is available. I would not touch it without a good reason.

If username + password used for the calendar application than using app passwords could reduce the number of created sessions.

#  This purges session files in session.save_path older than X,
#  where X is defined in seconds as the largest value of
#  session.gc_maxlifetime from all your SAPI php.ini files
#  or 24 minutes if not defined.  The script triggers only
#  when session.save_handler=files.
#
#  WARNING: The scripts tries hard to honour all relevant
#  session PHP options, but if you do something unusual
#  you have to disable this script and take care of your
#  sessions yourself.

# Look for and purge old sessions every 30 minutes
09,39 *     * * *     root   [ -x /usr/lib/php/sessionclean ] && if [ ! -d /run/systemd/system ]; then /usr/lib/php/sessionclean; fi

Please make sure that your session.save_path is purged from time to time. Above is from a debian system. By default the sessions path is checked for old files every 30 minutes.

I agree to the issue itself but your figures seems to be a configuration problem. Fair enough it's not possible to use app passwords everywhere but cleaning the sessions path is.

[martinlanger90]

I'm using a lot of calendar apps with webdav connection (macOS Calendar / Contacts are using this connection type for example). Everytime webdav connection is established a session file is generated. Should not be when using webdav or oauth2 connections. Purging files is just a workaroung but I'll try using that.

[kesselb]

I'm using a lot of calendar apps with webdav connection (macOS Calendar / Contacts are using this connection type for example). Everytime webdav connection is established a session file is generated.

I get that. Please make sure to setup calendar / contacts like described here: https://docs.nextcloud.com/server/latest/user_manual/pim/sync_osx.html (use app password instead of your actual password).

Purging files is just a workaroung but I'll try using that.

It's anything but not a workaround. There is a good reason that this is enabled by default (at least for debian/ubuntu).

[nooblag]

... Please make sure to setup calendar / contacts like described here: https://docs.nextcloud.com/server/latest/user_manual/pim/sync_osx.html (use app password instead of your actual password).

Hi there, this link is dead.