Page MenuHomePhabricator

Disable PHPSessionHandler in Wikimedia production
Closed, ResolvedPublic

Description

PHPSessionHandler registers SessionManager as a PHP session handler, which means that SessionManager methods are invoked (through PHPSessionHandler methods) at various points in the request lifetime. This is in theory only necessary for compatibility with extension code which uses PHP session handling ($_SESSION, session_start() etc), which hopefully doesn't happen anymore as it was deprecated a decade ago.

In practice though, I don't think disabling PHPSessionHandler was ever tried on any large wiki, so it needs some testing. Nevertheless, it's worth doing this in Wikimedia production - it makes the system much easier to reason about, and probably yields some performance improvement too.

We'd have to set $wgPHPSessionHandling = 'warn', run for a few weeks to see if there are any warnings, then set $wgPHPSessionHandling = 'disable' and watch another few weeks for errors. If all goes well, eventually we'll probably want to follow with an identical change in the MediaWiki default config as well.

Related Objects

Event Timeline

There are a very large number of changes, so older changes are hidden. Show Older Changes

Change #1140725 had a related patch set uploaded (by Máté Szabó; author: Máté Szabó):

[operations/mediawiki-config@master] Set wgPHPSessionHandling to 'warn' on testwiki

https://gerrit.wikimedia.org/r/1140725

Change #1144497 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[operations/mediawiki-config@master] Set $wgPHPSessionHandling to 'disable'

https://gerrit.wikimedia.org/r/1144497

Change #1140725 merged by jenkins-bot:

[operations/mediawiki-config@master] Set wgPHPSessionHandling to 'warn'

https://gerrit.wikimedia.org/r/1140725

Mentioned in SAL (#wikimedia-operations) [2025-05-12T12:36:23Z] <tgr@deploy1003> Started scap sync-world: Backport for [[gerrit:1143962|Get rid of ancient session_name call (T124371)]], [[gerrit:1144495|Do not use $_SESSION (T29887 T124371)]], [[gerrit:1140725|Set wgPHPSessionHandling to 'warn' (T362324)]]

Mentioned in SAL (#wikimedia-operations) [2025-05-12T12:52:41Z] <tgr@deploy1003> tgr, mszabo: Backport for [[gerrit:1143962|Get rid of ancient session_name call (T124371)]], [[gerrit:1144495|Do not use $_SESSION (T29887 T124371)]], [[gerrit:1140725|Set wgPHPSessionHandling to 'warn' (T362324)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)

Mentioned in SAL (#wikimedia-operations) [2025-05-12T13:08:36Z] <tgr@deploy1003> Finished scap sync-world: Backport for [[gerrit:1143962|Get rid of ancient session_name call (T124371)]], [[gerrit:1144495|Do not use $_SESSION (T29887 T124371)]], [[gerrit:1140725|Set wgPHPSessionHandling to 'warn' (T362324)]] (duration: 32m 12s)

errors

I think it's bogus, PHPSessionHandler gets confused when the session is dirty on shutdown. The order of things is probably wrong in SessionManager::shutdown().

(But note also that zero errors wouldn't necessarily make this a no-op change. Even when the deprecation logging isn't triggered, it perturbs the order of session handling function calls quite a bit.)

Change #1155299 had a related patch set uploaded (by Bartosz Dziewoński; author: Bartosz Dziewoński):

[operations/mediawiki-config@master] Set $wgPHPSessionHandling to 'disable' on testwiki and beta cluster

https://gerrit.wikimedia.org/r/1155299

Change #1155299 merged by jenkins-bot:

[operations/mediawiki-config@master] Set $wgPHPSessionHandling to 'disable' on testwiki and beta cluster

https://gerrit.wikimedia.org/r/1155299

Mentioned in SAL (#wikimedia-operations) [2025-06-11T13:56:58Z] <lucaswerkmeister-wmde@deploy1003> Started scap sync-world: Backport for [[gerrit:1155299|Set $wgPHPSessionHandling to 'disable' on testwiki and beta cluster (T362324)]], [[gerrit:1155303|Stop logging $wgPHPSessionHandling warnings for now (T393963)]]

Mentioned in SAL (#wikimedia-operations) [2025-06-11T13:59:08Z] <lucaswerkmeister-wmde@deploy1003> matmarex, lucaswerkmeister-wmde: Backport for [[gerrit:1155299|Set $wgPHPSessionHandling to 'disable' on testwiki and beta cluster (T362324)]], [[gerrit:1155303|Stop logging $wgPHPSessionHandling warnings for now (T393963)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Mentioned in SAL (#wikimedia-operations) [2025-06-11T14:08:12Z] <lucaswerkmeister-wmde@deploy1003> Finished scap sync-world: Backport for [[gerrit:1155299|Set $wgPHPSessionHandling to 'disable' on testwiki and beta cluster (T362324)]], [[gerrit:1155303|Stop logging $wgPHPSessionHandling warnings for now (T393963)]] (duration: 11m 14s)

Change #1181697 had a related patch set uploaded (by Bartosz Dziewoński; author: Bartosz Dziewoński):

[operations/mediawiki-config@master] Set wgPHPSessionHandling to 'warn' again

https://gerrit.wikimedia.org/r/1181697

Change #1181697 merged by jenkins-bot:

[operations/mediawiki-config@master] Set wgPHPSessionHandling to 'warn' again

https://gerrit.wikimedia.org/r/1181697

Mentioned in SAL (#wikimedia-operations) [2025-08-25T13:13:36Z] <lucaswerkmeister-wmde@deploy1003> Started scap sync-world: Backport for [[gerrit:1181695|PHPSessionHandler: In warn mode, report the changed keys (T400668)]], [[gerrit:1181697|Set wgPHPSessionHandling to 'warn' again (T362324)]]

Mentioned in SAL (#wikimedia-operations) [2025-08-25T13:20:04Z] <lucaswerkmeister-wmde@deploy1003> lucaswerkmeister-wmde, matmarex: Backport for [[gerrit:1181695|PHPSessionHandler: In warn mode, report the changed keys (T400668)]], [[gerrit:1181697|Set wgPHPSessionHandling to 'warn' again (T362324)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Mentioned in SAL (#wikimedia-operations) [2025-08-25T13:26:50Z] <lucaswerkmeister-wmde@deploy1003> Finished scap sync-world: Backport for [[gerrit:1181695|PHPSessionHandler: In warn mode, report the changed keys (T400668)]], [[gerrit:1181697|Set wgPHPSessionHandling to 'warn' again (T362324)]] (duration: 13m 14s)

Change #1182857 had a related patch set uploaded (by Hokwelum; author: Hokwelum):

[operations/mediawiki-config@master] Set $wgPHPSessionHandling to 'disable' on group0 wikis

https://gerrit.wikimedia.org/r/1182857

Change #1182857 merged by jenkins-bot:

[operations/mediawiki-config@master] Set $wgPHPSessionHandling to 'disable' on group0 wikis

https://gerrit.wikimedia.org/r/1182857

Mentioned in SAL (#wikimedia-operations) [2025-08-28T20:06:12Z] <dancy@deploy1003> Started scap sync-world: Backport for [[gerrit:1182857|Set $wgPHPSessionHandling to 'disable' on group0 wikis (T362324)]]

Mentioned in SAL (#wikimedia-operations) [2025-08-28T20:10:12Z] <dancy@deploy1003> hokwelum, dancy: Backport for [[gerrit:1182857|Set $wgPHPSessionHandling to 'disable' on group0 wikis (T362324)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Mentioned in SAL (#wikimedia-operations) [2025-08-28T20:20:08Z] <dancy@deploy1003> Finished scap sync-world: Backport for [[gerrit:1182857|Set $wgPHPSessionHandling to 'disable' on group0 wikis (T362324)]] (duration: 13m 56s)

Change #1183741 had a related patch set uploaded (by Hokwelum; author: Hokwelum):

[operations/mediawiki-config@master] Set $wgPHPSessionHandling to 'disable' on group1 wikis

https://gerrit.wikimedia.org/r/1183741

Change #1183741 merged by jenkins-bot:

[operations/mediawiki-config@master] Set $wgPHPSessionHandling to 'disable' on group1 wikis

https://gerrit.wikimedia.org/r/1183741

Mentioned in SAL (#wikimedia-operations) [2025-09-02T13:42:41Z] <kartik@deploy1003> Finished scap sync-world: Backport for [[gerrit:1183741|Set $wgPHPSessionHandling to 'disable' on group1 wikis (T362324)]] (duration: 17m 28s)

Change #1184161 had a related patch set uploaded (by Lucas Werkmeister; author: Lucas Werkmeister):

[operations/mediawiki-config@master] Revert "Set $wgPHPSessionHandling to 'disable' on group1 wikis"

https://gerrit.wikimedia.org/r/1184161

Change #1184161 merged by jenkins-bot:

[operations/mediawiki-config@master] Revert "Set $wgPHPSessionHandling to 'disable' on group1 wikis"

https://gerrit.wikimedia.org/r/1184161

Mentioned in SAL (#wikimedia-operations) [2025-09-02T21:01:36Z] <lucaswerkmeister-wmde@deploy1003> Started scap sync-world: Backport for [[gerrit:1184161|Revert "Set $wgPHPSessionHandling to 'disable' on group1 wikis" (T362324 T403519)]]

Mentioned in SAL (#wikimedia-operations) [2025-09-02T21:06:20Z] <lucaswerkmeister-wmde@deploy1003> lucaswerkmeister-wmde, lucaswerkmeister: Backport for [[gerrit:1184161|Revert "Set $wgPHPSessionHandling to 'disable' on group1 wikis" (T362324 T403519)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Mentioned in SAL (#wikimedia-operations) [2025-09-02T21:15:03Z] <lucaswerkmeister-wmde@deploy1003> Finished scap sync-world: Backport for [[gerrit:1184161|Revert "Set $wgPHPSessionHandling to 'disable' on group1 wikis" (T362324 T403519)]] (duration: 13m 27s)

Change #1184166 had a related patch set uploaded (by Lucas Werkmeister; author: Lucas Werkmeister):

[operations/mediawiki-config@master] Revert "Set $wgPHPSessionHandling to 'disable' on group0 wikis"

https://gerrit.wikimedia.org/r/1184166

Change #1184166 merged by jenkins-bot:

[operations/mediawiki-config@master] Revert "Set $wgPHPSessionHandling to 'disable' on group0 wikis"

https://gerrit.wikimedia.org/r/1184166

Mentioned in SAL (#wikimedia-operations) [2025-09-02T21:55:54Z] <lucaswerkmeister-wmde@deploy1003> Started scap sync-world: Backport for [[gerrit:1184166|Revert "Set $wgPHPSessionHandling to 'disable' on group0 wikis" (T362324 T403519)]]

Mentioned in SAL (#wikimedia-operations) [2025-09-02T22:00:16Z] <lucaswerkmeister-wmde@deploy1003> lucaswerkmeister, lucaswerkmeister-wmde: Backport for [[gerrit:1184166|Revert "Set $wgPHPSessionHandling to 'disable' on group0 wikis" (T362324 T403519)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Mentioned in SAL (#wikimedia-operations) [2025-09-02T22:05:57Z] <lucaswerkmeister-wmde@deploy1003> Finished scap sync-world: Backport for [[gerrit:1184166|Revert "Set $wgPHPSessionHandling to 'disable' on group0 wikis" (T362324 T403519)]] (duration: 10m 03s)

The deployments to group1 and group0 were reverted due to causing T403519. $wgPHPSessionHandling = 'disable' currently remains set only on testwiki. We'll need to debug that issue before attempting the rollout again.

Change #1187065 had a related patch set uploaded (by Bartosz Dziewoński; author: Bartosz Dziewoński):

[operations/mediawiki-config@master] Revert^2 "Set $wgPHPSessionHandling to 'disable' on group0 wikis"

https://gerrit.wikimedia.org/r/1187065

Change #1187066 had a related patch set uploaded (by Bartosz Dziewoński; author: Bartosz Dziewoński):

[operations/mediawiki-config@master] Revert^2 "Set $wgPHPSessionHandling to 'disable' on group1 wikis"

https://gerrit.wikimedia.org/r/1187066

Change #1187065 merged by jenkins-bot:

[operations/mediawiki-config@master] Revert^2 "Set $wgPHPSessionHandling to 'disable' on group0 wikis"

https://gerrit.wikimedia.org/r/1187065

Change #1187066 merged by jenkins-bot:

[operations/mediawiki-config@master] Revert^2 "Set $wgPHPSessionHandling to 'disable' on group1 wikis"

https://gerrit.wikimedia.org/r/1187066

Mentioned in SAL (#wikimedia-operations) [2025-09-10T20:27:38Z] <reedy@deploy1003> Started scap sync-world: Backport for [[gerrit:1187062|ApiQueryTokens: Persist any new token, instead of depending on the type (T403519)]], [[gerrit:1187063|ApiQueryTokens: Persist any new token, instead of depending on the type (T403519)]], [[gerrit:1187066|Revert^2 "Set $wgPHPSessionHandling to 'disable' on group1 wikis" (T362324)]], [[gerrit:1187065|Revert^2 "Set $wgPHPSessionHandling to 'disable'

Mentioned in SAL (#wikimedia-operations) [2025-09-10T20:32:07Z] <reedy@deploy1003> reedy, matmarex: Backport for [[gerrit:1187062|ApiQueryTokens: Persist any new token, instead of depending on the type (T403519)]], [[gerrit:1187063|ApiQueryTokens: Persist any new token, instead of depending on the type (T403519)]], [[gerrit:1187066|Revert^2 "Set $wgPHPSessionHandling to 'disable' on group1 wikis" (T362324)]], [[gerrit:1187065|Revert^2 "Set $wgPHPSessionHandling to 'disable' on grou

Mentioned in SAL (#wikimedia-operations) [2025-09-10T20:41:47Z] <reedy@deploy1003> Finished scap sync-world: Backport for [[gerrit:1187062|ApiQueryTokens: Persist any new token, instead of depending on the type (T403519)]], [[gerrit:1187063|ApiQueryTokens: Persist any new token, instead of depending on the type (T403519)]], [[gerrit:1187066|Revert^2 "Set $wgPHPSessionHandling to 'disable' on group1 wikis" (T362324)]], [[gerrit:1187065|Revert^2 "Set $wgPHPSessionHandling to 'disable

We're back to group0 and group1 after fixing that bug. We should wait a few days and roll out to the remaining wikis (group2) if no new issues are reported.

Change #1144497 had a related patch set uploaded (by Bartosz Dziewoński; author: Gergő Tisza):

[operations/mediawiki-config@master] Set $wgPHPSessionHandling to 'disable' on remaining wikis

https://gerrit.wikimedia.org/r/1144497

Change #1144497 merged by jenkins-bot:

[operations/mediawiki-config@master] Set $wgPHPSessionHandling to 'disable' on remaining wikis

https://gerrit.wikimedia.org/r/1144497

Mentioned in SAL (#wikimedia-operations) [2025-09-15T14:14:28Z] <lucaswerkmeister-wmde@deploy1003> Started scap sync-world: Backport for [[gerrit:1144497|Set $wgPHPSessionHandling to 'disable' on remaining wikis (T362324)]]

Mentioned in SAL (#wikimedia-operations) [2025-09-15T14:20:18Z] <lucaswerkmeister-wmde@deploy1003> lucaswerkmeister-wmde, tgr: Backport for [[gerrit:1144497|Set $wgPHPSessionHandling to 'disable' on remaining wikis (T362324)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Mentioned in SAL (#wikimedia-operations) [2025-09-15T14:30:18Z] <lucaswerkmeister-wmde@deploy1003> Finished scap sync-world: Backport for [[gerrit:1144497|Set $wgPHPSessionHandling to 'disable' on remaining wikis (T362324)]] (duration: 15m 49s)

This is done, we're not seeing any related errors in the logs and no one seems to be complaining.

Filed T404636: Deprecate PHPSessionHandler and $wgPHPSessionHandling for deprecating and eventually removing these features from MediaWiki entirely.