Skip to content

docs(basics/controllers): clarify session variable usage, locking, best practices#14037

Merged
skjnldsv merged 3 commits intomasterfrom
jtr/dev-sessions-clarifications
Apr 29, 2026
Merged

docs(basics/controllers): clarify session variable usage, locking, best practices#14037
skjnldsv merged 3 commits intomasterfrom
jtr/dev-sessions-clarifications

Conversation

@joshtrichards
Copy link
Copy Markdown
Member

@joshtrichards joshtrichards commented Jan 29, 2026

☑️ Resolves

This PR improves and clarifies the documentation for session handling and session variables for developers.

Completed while working on nextcloud/server#57794

Key updates:

  • Clearly describes what sessions and session variables are for in web apps.
  • Explains that Nextcloud uses PHP's native session mechanism enhanced with its own encryption and performance optimizations.
  • Clarifies the distinction between the use of ISession and raw $_SESSION, warning against the latter.
  • Documents the default on-demand locking behavior for session writes, including when (and why) the #[UseSession] attribute should be used for efficiency.
  • Provides modern, practical, and safe code examples.
  • Enumerates key methods of the ISession API and links directly to its definition.
  • Adds more actionable warnings and notes on concurrency, race conditions, and locking for developers.

This brings the documentation fully in line with actual Nextcloud session implementation and gives app authors clear, accurate advice for robust and performant apps.

🖼️ Screenshots

image

Copy link
Copy Markdown
Contributor

@kesselb kesselb left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks a lot 🙏

It reads well. I am not deep enough into our session handling code to approve this, but I will ask around for another reviewer.

Comment thread developer_manual/basics/controllers.rst Outdated
Comment thread developer_manual/basics/controllers.rst Outdated
// write a session variable
$this->session['value'] = 'new value';
}
The entire ``OCP\\ISession`` API:
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shouldn't duplicate this list here. Just link to the file instead.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done in 79b0ebe — removed the method list and replaced it with a single link to ISession.php.

Comment thread developer_manual/basics/controllers.rst
@blizzz blizzz modified the milestones: Nextcloud 33, Nextcloud 34 Feb 16, 2026
…d API best practices

Signed-off-by: Josh <josh.t.richards@gmail.com>
Signed-off-by: Josh <josh.t.richards@gmail.com>
…rce instead

Agent-Logs-Url: https://github.com/nextcloud/documentation/sessions/27800d6c-aa12-41dc-a65f-0a927234ce8c

Co-authored-by: nextcloud-command <88102737+nextcloud-command@users.noreply.github.com>
auto-merge was automatically disabled April 29, 2026 06:41

Head branch was pushed to by a user without write access

Copilot AI requested a review from nextcloud-command April 29, 2026 06:42
@skjnldsv skjnldsv merged commit 18cb3eb into master Apr 29, 2026
23 checks passed
@skjnldsv skjnldsv deleted the jtr/dev-sessions-clarifications branch April 29, 2026 06:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants