Yii2 CacheSession “randomly” destroyed

Question

Problem

Essentially, I have a Yii2 web application that requires all users to login. Users are able to login successfully, but are "randomly" being logged out of the system. This is happening 2-3 times per day for about 50% of my users.

Users will be active on the system and then upload a file or save a form and instead of completing the action successfully, users are brought to the login screen, meaning that their session expired and they need to login again.

Notes

• My original configuration used the FileCache for sessions. In hopes of solving the problem, I implemented a Redis cache, but the problem persists.
• There is javascript code that is setup to automatically log out users after their session expires, but a warning is given first, and this code is not executing in these instances.

Configuration

Yii2 Config (Original)

'session' => ['class' => 'yii\web\CacheSession'],
'cache' => ['class' => 'yii\caching\FileCache'],
'user' => [
            'class' => 'app\models\YiiUser',
            'identityClass' => 'app\models\User',
            'enableAutoLogin' => false,
            'enableSession' => true,
            'authTimeout' => 1200, // 20 min (in seconds)
        ],

Yii2 Config (Updated "cache")

'cache' => [
        'class' => 'yii\redis\Cache',  
        'redis' => [
            'hostname' => 'localhost',
            'port' => 6379,
            'database' => 0,
        ]
    ],

PHP Config

session.save_handler = files
session.use_cookies = 1
session.use_only_cookies = 1
session.name = PHPSESSID
session.auto_start = 0
session.cookie_lifetime = 0
session.cookie_path = /
session.cookie_domain =
session.cookie_httponly =
session.serialize_handler = php
session.gc_probability = 1
session.gc_divisor = 1000
session.gc_maxlifetime = 1440

I'm really struggling so any guidance, questions, or suggestions would be greatly appreciated. Even just some advice on where to add some logging would be helpful.

Answer 1

After extended testing, I was able to consistently recreate the issue by rapidly refreshing any page in our app (with the FileCache setup). What was happening is that the session was still there, but all values (ie our user id) would be cleared. So the session could be found but it was empty.

I then reached back out to our users with a new understanding that they hadn't experienced the issue since the Redis change. I was also unable to replicate with the Redis backend. Ultimately, this was more of a communication issue than anything else - sorry!

I think we were ultimately victims of PHP session locking as described here: https://ma.ttias.be/php-session-locking-prevent-sessions-blocking-in-requests/