search

openwebwork / webwork2

Course management front end for WeBWorK
http://webwork.maa.org/wiki/Main_Page
Other
141 stars 164 forks source link

Use an unpadded session. #2391

Closed drgrice1 closed 2 months ago

drgrice1 commented 3 months ago

This changes the serialization method used by Mojo::Sessions to merely JSON encode the session without padding. The default serialization method JSON encodes the session and then pads it with the letter Z to a length of 1025 characaters.

This results in much smaller session cookies (roughly one fifth the previous size). Thus it is possible to be signed in to more courses at a time without hitting the cookie size limit.

This should perhaps only be considered if the limit on the number of courses that can be signed into at one time is deemed to be a big enough problem that something needs to be done.

Alex-Jordan commented 3 months ago

I'm hitting this issue a lot, but of course it is because I've been logging into other people's courses to help with this and that.

There's one instructor here with two sections of a course, and this instructor likes to use one WW course for homework and a separate one for quizzes. They have certain global config settings different and find it easier to shut off access to HW that way during a scheduled test. So this instructor has four WW courses, which is the limit under this issue. It wouldn't be hard to imagine a need for this instructor to have a fifth one.

So I think this is a good change. I'll try it out soon.

drgrice1 commented 2 months ago

I think that we should go with this pull request. To be honest, I don't understand what the advantage of padding the session is, and I don't see any real downside to removing the padding. It seems that the padding just artificially inflates the cookie size.