0

The PHP HybridAuth require the use of PHP session, however, we want to avoid using server side session since we are running the app on multiple machine.

We don't mind if user need to authenticate with provider every-time when needed, so, is it possible to avoid the need of using PHP session when using the HybridAuth?

[1] http://hybridauth.sourceforge.net/userguide/HybridAuth_Sessions.html

Ryan
  • 10,041
  • 27
  • 91
  • 156
  • If you don't want to use sessions, then what do you want to use? Nothing else would be secure. You could store server side session data to a single place that multiple servers can access or even use a database session wrapper that all servers can access if they are touching the same database. – Jonathan Kuhn Oct 30 '14 at 18:18
  • Help us understand what running the app on multiple machines has to do with not wanting 5o use sessions. The session var will be unique for each user. What is the problem with that? – Len_D Oct 30 '14 at 18:18
  • We store the encrypted user id in user's browser cookie, so we don't need to use server side session. – Ryan Oct 31 '14 at 03:15

2 Answers2

1

Short answer is no.

A longer answer is that it is possible (but in most cases will require sessions on the authentication provider) but to explain the options here would take far too long and from the tone of your question you would need a very detailed description of the potential options.

But this based on a premise that you can't have sessions across multiple machines. This is trivial. Even running sessions across multiple datacentres is a simpler solution And since you don't appear to be using the session for anything other than authentication you are not going to run into problems of scalability.

symcbean
  • 47,736
  • 6
  • 59
  • 94
  • Because in our app we store the encrypted user id in user's browser cookie, so we don't need to use server side session. When integrating using HybridAuth we've found they have used $_SESSION multiple ways which broke our design.. – Ryan Oct 31 '14 at 03:16
0

If you don't use PHP session mechanism for your application, you can override the default session storage by creating your own storage functions, with awareness of multiple servers.

For instance: http://php.net/manual/en/function.session-set-save-handler.php

You can then either set the session in Memcached (for this particular case, you should only use php.ini with the following instructions: http://php.net/manual/fr/memcached.sessions.php), or MySQL, or a physical storage accessible by all servers (such as NFS).

Although, I think that even if you have multiple servers, default is to redirect the user to the same IP address (in DNS Round-Robin declaration, or in standard load-balancers), so a unique storage on each server, not visible by the other servers, should work.

Yvan
  • 2,539
  • 26
  • 28