How to Implement Distributed User Sessions with Apache and Redis

1. Prerequisite: Redis installation on Windows 8.1 and the implementation process for configuring PHP support: https://www.shuijingwanwq.com/2015/11/16/769/

Configure the Redis server to allow access from specific IPs and set a password, as shown in Figures 1 and 2:

bind 127.0.0.1 192.168.2.30

requirepass n#S7yLE$R5s&Mmp#W9K9*HjZApTU%hpQ

Command: service redis restart, restart the Redis service;

2. Configure php.ini on the web server, as shown in Figure 3:

; session.save_handler = files
session.save_handler = redis

; session.save_path = “/tmp”
; session.save_path = “D:/phpsessiontmp”
session.save_path = “tcp://192.168.2.30:6379?auth=n#S7yLE$R5s&Mmp#W9K9*HjZApTU%hpQ”
A strong hash function produces a strong session ID. Although finding an identical hash value is already very difficult even with the MD5 hash algorithm, developers should still choose SHA-2 or higher hash algorithms, such as sha384 or sha512.
; session.hash_function = 0
session.hash_function = “sha512”

Restart the Apache service;
Generated: PHPSESSID:”llg6i9ddv0m012ajrhki8nn675q42an11k87sjaqd8lj53bnelb32v4gvkh7fn3pelp9eec8os1tk430aqp45tj1uisg6sgfk0qeer2″

3. Edit the phpRedisAdmin configuration file so it runs properly, as shown in Figures 4 and 5:

$config = array(
‘servers’ => array(
array(
‘name’ => ‘local server’, // Optional name.
‘host’ => ‘192.168.2.30’,
‘port’ => 6379,
‘filter’ => ‘*’,

// Optional Redis authentication.
‘auth’ => ‘n#S7yLE$R5s&Mmp#W9K9*HjZApTU%hpQ’ // Warning: The password is sent in plain-text to the Redis server.
),

4. Write a test program, as shown in Figure 6:

<?php
//header(“Content-type: text/html; charset=utf-8”);
session_start();
$_SESSION[‘count’] = 1;
echo $_SESSION[‘count’];
?>

5. A test error occurs, as shown in Figure 7:
Fatal error: Uncaught exception ‘RedisException’ with message ‘Failed to AUTH connection’ in E:\wwwroot\phpinfo.php:4 Stack trace: #0 E:\wwwroot\phpinfo.php(4): session_start() #1 {main} thrown in E:\wwwroot\phpinfo.php on line 4

Fatal error: Uncaught exception ‘RedisException’ with message ‘Failed to AUTH connection’ in [no active file]:0 Stack trace: #0 {main} thrown in [no active file] on line 0

6. Solution: Change the password again. It cannot contain special characters; only numbers and letters are allowed. This resolves the issue, and the test program runs normally, as shown in Figure 8:

7. Next, prepare to implement storing sessions in Redis on a web server running CentOS by executing the command, as shown in Figure 9:
php -m

Check if the php-redis extension is already installed (or check phpinfo(), as shown in Figure 10). If not, execute the command, as shown in Figure 11:
yum install php-redis

8. Configure php.ini on the web server, as shown in Figures 12 and 13:

; session.save_handler = files
session.save_handler = redis

; session.hash_function = 0
session.hash_function = “sha512”

Restart the Apache service;

9. Edit /etc/httpd/conf.d/php.conf, as shown in Figure 14.

# php_value session.save_handler “files”
# php_value session.save_path “/var/lib/php/session”
php_value session.save_handler “redis”
php_value session.save_path “tcp://192.168.2.30:6379?auth=2LMDCDh7CfWhJGC9bAuercMEZYULs25y”

Restart the Apache service;

10. At this point, user login on the CentOS-based web server can run normally, but the PHPSESSID is still MD5-encrypted rather than SHA-512. The reason is that the browser still holds a PHPSESSID cookie, as shown in Figures 15 and 16.

11. If the browser does not have a cookie named PHPSESSID, the PHPSESSID will be SHA-512-encrypted, as shown in Figure 17.