sessions table not pruning?

[sts-ryan-holton]

Laravel Version

11.15.0

PHP Version

8.3.7

Database Driver & Version

MySQL 8

Description

I'm using the sessions table for authentication. I only have a user or two in my database, yet have over 9,000 sessions stored in the sessions table. I'm using Laravel Livewire and everything in one system.

Really the sessions table should be pruned

Steps To Reproduce

env config:

SESSION_DRIVER=database
SESSION_LIFETIME=1440
SESSION_ENCRYPT=false
SESSION_PATH=/
SESSION_DOMAIN=null

[rodrigopedra]

Session data is pruned depending on a random number generated at each request.

This mechanic is referred as lottery. It is configured on your app's ./config/session.php file:

https://github.com/laravel/laravel/blob/4ef5e2f89e987f84b33b62f79e96485dcaa8f209/config/session.php#L106-L117

If your app has a very low request count, you can try increasing the odds of session data being pruned (aka garbage collected).

As an alternative, you can write an artisan command that runs this garbage collection mechanics, and use the command scheduler to run it periodically.

[rodrigopedra]

This should help you out

<?php // ./routes/console.php

use Illuminate\Support\Facades\Artisan;

Artisan::command('session:gc', function () {
    session()->getHandler()->gc(60 * config('session.lifetime'));
})->twiceDaily();

[sts-ryan-holton]

@rodrigopedra My application gets around 750 - 1,000 requests per minute with each request ranging from maybe a few ms to seconds.

I'm slightly confused on the sessions table then because I thought this table would exclusively be for "users" of the application, e,g: those that log in to the system.

I have some publically accessible API endpoints that are consumed but other systems that are no-auth endpoints, it would appear that these too enter the sessions table but are never cleared?

[rodrigopedra]

Every request that goes under the web middleware group will have a session created.

If your public facing site does not need any kind of session data, you can create a new middleware group and apply to those routes.

Regarding the API endpoints, those should not have any session attached. Run:

php artisan route:list -v

And check which middleware are applied to these routes. The -v parameter is what tells the route:list command to show each route's middleware, don't omit it.

Also, only define API endpoints on your ./routes/api.php file.

[sts-ryan-holton]

API routes are only defined in my API routes file. These are the public ones. I've implemented that session garbage handler command which I'll deploy next week. Just to clarify the purposes of doing the 60 * config('session.lifetime')?

My session lifetime variable is 1440, I'm presuming I could reduce the 60 down to something like 2 or 3?

[rodrigopedra]

The gc() methods expects the session lifetime in seconds.

In the configuration file, you define it in minutes.

The 60 * config('session.lifetime') just converts minutes to seconds.

Internally, it will delete sessions that are stale for more than that threshold.

framework/src/Illuminate/Session/DatabaseSessionHandler.php

Lines 279 to 282 in f5f9383

	public function gc($lifetime): int
	{
	return $this->getQuery()->where('last_activity', '<=', $this->currentTime() - $lifetime)->delete();
	}

[rodrigopedra]

That is the same that the StartSession middleware uses when calling the garbage collection mechanism:

framework/src/Illuminate/Session/Middleware/StartSession.php

Lines 170 to 180 in f5f9383

	protected function collectGarbage(Session $session)
	{
	$config = $this->manager->getSessionConfig();
	// Here we will see if this request hits the garbage collection lottery by hitting
	// the odds needed to perform garbage collection on any given request. If we do
	// hit it, we'll call this handler to let it delete all the expired sessions.
	if ($this->configHitsLottery($config)) {
	$session->getHandler()->gc($this->getSessionLifetimeInSeconds());
	}
	}

framework/src/Illuminate/Session/Middleware/StartSession.php

Lines 254 to 257 in f5f9383

	protected function getSessionLifetimeInSeconds()
	{
	return ($this->manager->getSessionConfig()['lifetime'] ?? null) * 60;
	}