Skip to content

Do not write session tracking data on a read-only replica - #26246

Open
trasher wants to merge 3 commits into
glpi-project:12.0/bugfixesfrom
trasher:fix/26240
Open

trasher wants to merge 3 commits into
glpi-project:12.0/bugfixesfrom
trasher:fix/26240

Conversation

@trasher

@trasher trasher commented Nov 6, 2026

Copy link
Copy Markdown
Contributor

Fixes #26240

@qodo-free-for-open-source-projects

This comment was marked as resolved.

- refuse new logins on a replica, as their session cannot be recorded
  and would be considered as invalid on the next request;
- refuse session revocation on a replica, except for user logout;
- do not create or delete "remember me" tokens on a replica.
@trasher

trasher commented Nov 6, 2026

Copy link
Copy Markdown
Contributor Author

On last commit:

refuse new logins on a replica, as their session cannot be recorded and would be considered as invalid on the next request

Can be considered as a kind of "regression" comparing to v11 - but with current login workflow it seem the cleaner and safer solution to implement. Alternative solution would require more work.

Comment thread src/Glpi/Security/SessionTracker.php Resolved
Co-authored-by: Romain B. <8530352+Rom1-B@users.noreply.github.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

SQL replica fallback (read-only mode) fails on every request in 12.x: SessionActivityListener tries to UPDATE glpi_users_sessions on the replica

2 participants