Stop initializing sessions for public assets
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 36.9k
- Forks
- 5.2k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 713
Description
Even though public asset endpoints (css, favicon) attempt to not require sessions, there is logic that triggers session setup (in lib/base.php) before annotations/attributes are useful.
Currently we special case (exclude) for /status.php. We could probably stick more in here (e.g. /core/{img, css, fonts, js} and /apps/theming/{theme, image, favicon, icon} or perhaps provide some sort of way for routes to be registered (early) to be excluded. Or maybe use the existing annotation/attributes, etc.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in lib/base.php around lines 397-403 and trace how session setup is triggered before annotations or attributes are available. Compare the handling of /status.php with the listed public asset paths and evaluate the proposed early route exclusions. Done means public asset requests no longer initialize sessions, with the chosen behavior verified for the listed endpoints.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- backend, performance
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100