OOP Object in Session, when not to?

Question

i'm wondering when should i not store Objects in Sessions?

i'm working on a user-driven system, and i need to define messages for example, after login "Welcome back User", or on wrong login information, and these messages they have a different types "error,succes,warning, etc..." so i created a controller for it, i create a new object from that Message class, attach it as Serialized to the View, and the view unserializes it, and then removes it from the session.

I'm just having a feeling that im making a mistake here, is it ok to use this method from a performance perspective, what security issues can be with it, and does the object remain in the server-side memory? or should i handle flushing it as well?

Mihai Stancu · Accepted Answer · 2014-02-07 12:38:53Z

2

Terminology:

These types of behaviors are usually called message flashes. They are implemented by most web frameworks and by all web applications.

Some use objects to represent them, some just arrays. If your "message object" is not very complex there's no reason to think it would be performance burden.

Security:

On the side of security session data in PHP is kept serialized (you don't need to serialize it yourself) and stored in a file on the server hard-disk somewhere. It can be retrieved based on the session ID cookie (which PHP sets up whenever you use session_start()).

Your security concern relates to the security of session data in general -- not the security of messages stored in sessions so you can research the subject of session data security separately.

Design:

Storing messages in the session until they are displayed to the user (and then removing them from the session) is commonplace and you should not worry about security issues with this approach.

On the other hand most MVC frameworks will use one controller per page which means that creating a particular controller just for handling messages wouldn't make sense (unless your MVC uses multiple controllers to render a page).

edited Feb 7, 2014 at 12:38

answered Feb 7, 2014 at 12:30

Mihai Stancu

16.2k2 gold badges35 silver badges51 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

UX Labs Over a year ago

thanks alot for this very descriptive and reliefing answer, i think i'm just missing some experience in MVC development, thanks to people like you we learn faster

Collectives™ on Stack Overflow

OOP Object in Session, when not to?

1 Answer 1

Terminology:

Security:

Design:

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Terminology:

Security:

Design:

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related