I am making a somewhat large rails app where users fill out a number of forms and in return are quoted for car insurance. The quoting engines are all external, as well as an external DB.
I have no need to store a session in a mysql, or similar, DB long-term.
What would be the best way to store these sessions.
CookieStore is insecure as well as too limited ( <4kb cookie ).
Memchached is a possibility except I do not like the idea of key => value pairs, I would like more associative arrays where possible.
Any DB related session store is redundant for these needs(?)
Some sort of file store system may be the way to go?
Please could someone advise on the best way to store the sessions?
Memcache or a database store are the way to go. In both cases, as your site scales, your many servers will be able to get/set session data.
I’ve used both in the past, and there are a few things you should know:
1) Both can store arbitrary data
A Rails session is treated like a Hash, and the value that gets stored is a serialized version of that Hash. In Memcache, the key => value pair are the session_id => session_contents. In a database store, you have two columns, one for the id and one for the contents.
2) Memcache is a little bit faster
Every little bit of speed helps; for this purpose, Memcache will be a smidge faster than a database.
3) Memcache has a tendency to drop keys when it gets full
If your Memcache instance starts running out of memory, it starts to drop keys. It does that by dropping the oldest ones first. Since sessions are actively used, you can mitigate this by tickling the session data on every request; that keeps them at the top of the pile. But if your instance gets really full, it’s possible that you’ll start dropping sessions on the floor and logging users out. This is typically only a problem in a situation of very rapid growth, like if you get slashdotted. Otherwise it’s easy enough to keep an eye on your Memcache server and ensure that you’re not running out of storage.
4) A database table will rapidly fill up with expired sessions
Memcache automatically drops old stuff. When a user doesn’t log out but simply abandons the session, you have to do the cleanup manually in the database. Typically this is best done with a daily cron job. If not, you end up with a bazillion stale records that slows down querying to that table.
Which is best for you? I don’t know. It depends on your situation, and the kinds of risk you’re willing to take on. I’ve never had the dropped sessions problem with memcache, but that really depends on what else you’re using memcache for. If you use it a lot, a second memcache instance just for sessions might be the way to go. Then there’s no risk of dropping ’em.