News for hackers. Stuff that matters.
Re:Scaling Play to Thousands of Concurrent Requests by mason55 on Friday September 06, 2013 @01:28PM (#6341554)
> The user session is kept in a browser cookie, and you have to live with it. This means that the session space is limited in size and type: you can only store strings. If you need to store objects, you’ll have to use the caching mechanism we discussed before.

This isn't quite right, or at least is presented weirdly. Caching is not done on a per-user basis whereas sessions are tied to a user. Scala chooses to use client-side sessions so that applications are automatically non-sticky which allows for effortless failover and horizontal scalability.

The caching mechanism will cache the output of a template but it's going to be cached for all users. Again, it makes for easy horizontal scalability, but you'd never say that the caching is an alternative to session data. They're for two totally different use cases.

Re:Scaling Play to Thousands of Concurrent Requests by jcranky on Friday September 06, 2013 @02:40PM (#6341953)
It is right that the cache is not done in a per-user basis - still, it is an option. The downside is that you have to associate to which user the data belongs by yourself. Its an extra effort, so its better be worth that effort - in my case the page is the same for all users, so this is not a problem.

Also, this is not an _Scala_ characteristic - it is the way Play Framework works. Other Scala frameworks might (and most do) things differently.

Re:Scaling Play to Thousands of Concurrent Requests by ExpiredLink on Friday September 06, 2013 @02:49PM (#6341999)
A browser cookie isn't a replacement for server-side sessions. You cannot store sensitive data (e.g. safety related information) in a browser cookie.
Re:Scaling Play to Thousands of Concurrent Requests by gnaritas on Friday September 06, 2013 @03:31PM (#6342184)
As long as you encrypt it, sure you can. It's no different than storing the session pointer in the cookie.
Re:Scaling Play to Thousands of Concurrent Requests by ChrisAntaki on Friday September 06, 2013 @05:27PM (#6342774)
Though, with every HTTP request, the client will be uploading the entire cookie. This could manifest as degraded responsiveness, especially for mobile devices.
Re:Scaling Play to Thousands of Concurrent Requests by gnaritas on Friday September 06, 2013 @05:33PM (#6342813)
That's the trade you make when using cookies. Nothing new there.
Re:Scaling Play to Thousands of Concurrent Requests by ExpiredLink on Saturday September 07, 2013 @05:00PM (#6346605)
Encrypted cookies? Just what hackers have been waiting for.
Re:Scaling Play to Thousands of Concurrent Requests by badman_ting on Friday September 06, 2013 @01:56PM (#6341704)
I think maybe part of what he was saying is that the session gets abused -- devs sometimes put things in there which are not actually unique to the user, because it's easy to do. And that's not even really an option here, unless it's a string.
Re:Scaling Play to Thousands of Concurrent Requests by jcranky on Friday September 06, 2013 @02:41PM (#6341960)
That is exactly the message! =D
Re:Scaling Play to Thousands of Concurrent Requests by continuations on Friday September 06, 2013 @02:24PM (#6341859)
I think by "caching", he meant "take all the session data you can't store in the cookie and out it in a cache server like Redis."
Re:Scaling Play to Thousands of Concurrent Requests by jcranky on Friday September 06, 2013 @02:41PM (#6341957)
It could be Redis, but Play Framework has a Caching mechanism built in already :)