11
Chit Chat / Re: Tips for Bots
Last post by shawnb61 -Quote from: nwsw – The session_start on every GET request, combined with db session storage, has a dramatic impact on the server. As an immediate mitigation, I forced sessions to use cookies:Code: [Select]sources/Session.php:
@ini_set('session.use_only_cookies', true);
I then configured nginx to no longer serve requests that contain the session id. This only helps until the bots stop including the session id in their requests.
I'll probably move the session management to a ramdisk until I can figure out how to lean out the need for sessions by unregistered guests.
Note that PHP is deprecating the passing of PHPSESSID via URL in 8.x, and it will be removed in 9.0.
That particular setting, 'use_only_cookies', will be retired soon - mainly because setting it to false is soon to be disallowed. More here:
https://wiki.php.net/rfc/deprecate-get-post-sessions
So... The idea is good - don't use PHPSESSID, and, since you're not generating it anymore, you can then block it via .htaccess.
SMF implementation: https://github.com/SimpleMachines/SMF/pull/8394
One part of the SMF implementation, this commit, can save a LOT of resources. It's causing some issues for forums that have guest-browsing disabled, though... Those issues are currently being addressed.:
https://github.com/SimpleMachines/SMF/pull/8394/changes/2f2a5e0ae404fd1adb408b87896ce00cca1715ec
The basic idea is that, since you cannot pass by URL, you MUST pass by cookie. So... When cookies are disabled, there is no way to pass the session. At all... So, don't even bother writing it. Note certain classes of bots either block cookies or don't use them, or pass their own PHPSESSID... All these variants cause more session writes.
These changes will be a hard requirement before PHP 9.0.
You are effectively giving bots total control over your DB writes... One step further, since they can flood you with writes, they can overwhelm your undo/redo logs. Which can further lead to issues with backups. Which can cause performance issues & even bring your site down...
So stop that...
The savings can border on the ridiculous:
In addition, this note outlines even further savings. The goal is to avoid driving up CPU during bot storms. I've been testing these on my site. Check out the CPU charts before/after:
https://www.simplemachines.org/community/index.php?msg=4199062
The more broad notes found here might also help:
https://www.simplemachines.org/community/index.php?topic=593895.0