implementation of ajax status check

Question

I am battling with race condition protection in PHP.

My application is written in symfony 1.4 and PHP locks session data until a page completes processing. I have a long running (~10 second) login script and I want to display a progress bar showing the user what is being done while they wait. (I want to actually display what is being done and not use a standard [faux] loading bar.)

Whenever a script calls session_start(), PHP locks that user's session data until that script completes. This prevents my status check ajax calls from returning anything until the longer running script completes. (My question on why my ajax calls were not asynchronous is here.)

I have devised a way to do this but I want to make sure this way is secure enough for general purposes (i.e.- this is not a banking application).

My idea is:

1. On authentication of username & password (before the long login script starts), a cookie is set on the client computer with a unique identifier.
2. This same unique identifier is written to a file on the server along with the client IP address.
3. While the long login script runs, it will update that file with the status of the login process.
4. The ajax status check will ping the server on a special page that does not use session_start(). This page will get the cookie value and the client IP and check the server side file for any status updates.

Are there any glaringly obvious problems with this solution?

Again, from the security angle, even if someone hacked this all they would get is a number representing the state of the login progress.

Answer 1

I don't see anything inherently wrong with the approach that you are proposing.

But if your machine has APC installed you can use apc_store and apc_fetch to store your status in a sort of shared memory instead of writing to disk. Use something like apc_store(SID, 'login not started') to initialize and update the request state in memory, then apc_fetch(SID) to retrieve it on subsequent requests.

There are other shared memory systems, including Apache, or even a database connection might be simpler.

Answer 2

I have same problem and think the trick is session_write_close() that frees the session file.

Please see my https://github.com/jlaso/MySession repository and check if this can be apply to your particular question.