I'm looking to implement sessions for a web server that I'm developing in my free time. Currently, it had cookie support, so users could implement their own session management, but this is something that should be handled by the web server. I'm faced with two secure options:
- Store it in memory, and expire the session if the user does not make a request over a certain amount of time. This has the advantage of speed; accessing the memory is fast. It's also easier to implement, but this is a non-concern.
or
- Store it in a database of some sort, and expire the session if the last_access time is over a certain amount of time. This has the advantage of persistence; a server shutdown, restart, etc. will not impact this. It would also be possible to use a database on another server for this purpose, allowing multiple servers to share sessions (e.g. for load balancing).
I'm trying to decide whether keeping sessions over a restart or shutdown is important enough to sacrifice the speed of storing it in memory, or whether I should simply cache sessions and store them in a database of some sort as a "backup", e.g. in the event of a crash or a restart, I would restore sessions (if they're not expired) from the database. Edit: This is in a single-threaded environment. It's not an option to multithread it.
From the perspective of the user of the web server, which is more important? Speed, or persistence?