Context
A user starts a long export and the same user's other PHP requests appear frozen, while another user's pages remain responsive. The server may have free workers and healthy database latency. A shared session lock can serialize requests that use the same session data, making the problem look like a general capacity issue.
A session stores per-user state across requests. Locking protects concurrent updates, but holding the lock during unrelated long work extends the waiting boundary. Prepare a staging account, the configured session handler and two controlled requests. The behavior of custom handlers needs its own review; do not assume every backend implements the default file handler's locking contract.
Test same-session behavior
- Reproduce concurrent requests with the same test cookie jar, then repeat with separate test sessions. Compare start and completion timing. Browsers and connection limits can also serialize work, so use a controlled request tool when necessary and verify that the server received both requests. Do not publish real session identifiers in diagnostic transcripts.
- Inspect where each request calls
session_start()and where it completes session work. Identify reads, writes and code that may keep the session open while generating a report or waiting on a remote dependency. A seemingly read-only endpoint may update a last-seen field or authentication state, so review actual behavior rather than the route name. - Verify the session handler and its concurrency semantics for the installed PHP and backend versions. Check whether a framework opens sessions automatically or reopens them later. Correlate request traces with session acquisition where supported. A slow database call after session acquisition can keep unrelated same-session requests waiting for the entire call.
- In staging, test releasing the session after required updates using the application's supported lifecycle, which may involve
session_write_close(). Review every later session write: after closure, changing the in-memory session array does not automatically establish a persisted update. The application must deliberately handle any later state change.
An illustrative export lock
In an illustrative customer portal, the export route loads permissions from the session, sets an audit flag and then builds a large file. A status poll starts with the same session but waits for the export to finish. Closing session ownership after the required update allows the poll to proceed, provided the export no longer depends on later persisted session writes.
| Observation | Check | Meaning |
|---|---|---|
| Same user waits, other user succeeds | Cookie/session separation | Session contention is plausible |
| Requests arrive at different times | Browser and transport behavior | Serialization may occur before PHP |
| Closing session improves overlap | Later writes and framework lifecycle | Correctness review still required |
| Custom handler behaves differently | Backend locking contract | Do not generalize file-session behavior |
Correct and verify state ownership
Shorten the section that owns the session rather than disabling its protection indiscriminately. Move long work after the required session interaction, or redesign durable job state outside the session where appropriate. Preserve authentication checks and request-level authorization; releasing a session lock does not authorize later business operations.
Verify parallel completion, correct persisted values, logout behavior and deliberate concurrent updates. Test failures and cancellations too, because an early release can expose previously hidden races. A faster status poll is not acceptance if the export silently loses a session update or continues after authorization should be revoked.
Maintain a session SOP
Document which routes hold session ownership, backend semantics and the rule for long-running work. Monitor same-session waiting separately from overall worker utilization. Include concurrency checks when framework or handler behavior changes. Clouvenix server performance can help isolate session contention from general server capacity.
Technical reference
PHP session closing and locking and canonical function reference.