在文件与数据库中存储 session 数据的优缺点是什么？

Question

When building a website, one have to decide how to store the session info, when a user is logged in.

What is a pros and cons of storing each session in its own file versus storing it in a database?

Answer 1

I generally wouldnt ever store this information in a file - you run the risk of potentially swapping this file in and out of memory (yes it could be cached at times) but I would rather use an in memory mechanism designed as such and you are then using something that is fairly nonstandard. In ASP.Net

1. you can use in in memory collection that is good for use on a single server. if you need multiple load balanced web servers (web farm) and a user could go to any other server as they come in for each request, this option is not good. If the web process restarts, the sessions are lost. They can also timeout.

2. You can use a state server in asp.net for multiple server access - this runs outside of your webserver's process. If the web process restarts - you are OK and multiple servers access this. This traffic going to the state server is not encrypted and you would ideally use IPSEC policies to secure the traffic in a more secure environment.

3. You can use sql server to manage state (automatically) by setting up the web.config to use sql server as your session database. This gives the advantage of a high performance database and multi server access.

4. You can use your own sessions in a database if you need them to persist to a long time outside of the normal mechanism and want tighter control on the database fields (maybe you want to query specific fields)

Also just out of curiosity - maybe you are referring to sessions as user preferences? In that case research asp.net profiles

Answer 2

Asp.net does not facilitate storing session in a file, i'm not sure about ror though. However storing session in the memory( of the same process) is faster than having it in a db. Having it in a DB may give better scallability to your application ( in case you want to deploy your application in a web farm environment - all the servers has a common (db) to look for session).

This code project article gives very good insight on asp.net session management.

Answer 3

I'm guessing, based on your previous questions, that this is being asked in the context of using perl's CGI::Application module, with CGI::Application::Plugin::Session. If you use that module with the default settings, it will write the session data into files stored in the /tmp directory - which is very similar to what PHP does. If your app is running in a shared hosting environment, you probably do NOT want to do this, for security reasons, since other users may be able to view/modify data in /tmp. You can fix this by writing the files into a directory that only you have permission to read/write (ie, not /tmp). While developing, I much prefer to use YAML for serialization, rather than the default (storable), since it is human-readable. If you have your own web server, and you're able to run your database (mysql) server on the same machine, then storing the session data in a database instead of a file will usually yield higher performance - especially if you're able to maintain a persistent database connection (ie using mod_perl or fastcgi). BUT - if your database is on a remote host, and you have to open a new connection each time you need to update session data, then performance may actually be worse, and writing to a file may be better. Note that you can also use sqlite, which looks like a database to your app, but is really just a file on your local file system. Regardless of performance, the database option may be undesirable in shared-host environments because of bandwidth limitations, and other resource restrictions. The performance difference is also probably negligible for a low-traffic site (ie, a few thousand hits per day).