[Tickets #9733] Re: Password lost during hordeauth authentication via API

[bugs at horde.org]

DO NOT REPLY TO THIS MESSAGE. THIS EMAIL ADDRESS IS NOT MONITORED.

Ticket URL: http://bugs.horde.org/ticket/9733
------------------------------------------------------------------------------
  Ticket             | 9733
  Updated By         | arjen+horde at de-korte.org
  Summary            | Password lost during hordeauth authentication via API
  Queue              | Horde Base
  Version            | Git master
  Type               | Bug
  State              | Resolved
  Priority           | 2. Medium
  Milestone          | 4.1
  Patch              |
  Owners             | Michael Rubinsky
------------------------------------------------------------------------------


arjen+horde at de-korte.org (2012-09-30 19:24) wrote:

> Forget about the above remark, the zero length sessions are created  
> regardless of the presence of the above line. So somehow when using  
> the Horde_Session_Null handler, the Horde configuring settings for  
> the session handler are ignored and the session handler as  
> configured in 'php.ini' is used.

Some more information for the above. In the 'php.ini' file, I have

session.save_handler = files

while Horde is configured to use memcache as session handler (see  
comment #38).

It looks like for each ActiveSync request, a zero-length session file  
is created. Most of them are removed almost immediately (when the  
connection is closed), but for some reason sometimes the connection  
stalls in the ESTABLISHED or CLOSE_WAIT state. In that case, the  
zero-length session file is finally removed when the lingering  
connection times out.

No session file is created if I comment out line 42 in rpc.php

     $session_control = 'none';

in which case ActiveSync request will create a memcache session, but  
which seems to be removed before the connection stalls.

What causes the Horde_Session_Null handler to create an empty session  
in the first place and why isn't it using memcache for storing the  
session, but instead falls back to the session handler defined in  
php.ini?