Are there limitations in PHP session handling?

Question

I've seen many sites give up the use of the default handling of sessions in PHP for their own method and I still have no clue why.

They are definitely running PHP and it just seems pointless to me that people would design their own method. Is there some sort of limitation that I do not know of or is it purely so they have control of everything?

(I tried asking them and yeah they either didn't have a way of contacting them or they "saw something somewhere against using PHP sessions" without knowing what it actually was)

Answer 1

Default sessions are stored on the hard drive, usually in the /tmp directory. When your site gets larger, 1 computer isn't sufficient to run it. Therefore, people resort to load balancing (among other solutions).

Load balancer effectively switches between a cluster of computers. Therefore, if by any chance you got served by computer #1 on your first request and then by computer #2 at your second request - the second computer cannot read the session since it's not in its /tmp folder.

This is a simplified scenario of course since there's much more to application scaling but this is one of the reasons why people resort to overriding the default session mechanism.

The other thing of interest is storing sessions in the db thus making them searchable and what not. You can also create an interface for effectively forcefully logging people out, which is something that the default mechanism cannot provide.