MySQL Bugs: #47339: MySqlSessionStateProvider truncates sessions at 64 kb

Bug #47339	MySqlSessionStateProvider truncates sessions at 64 kb
Submitted:	15 Sep 2009 20:43	Modified:	18 Sep 2009 10:32
Reporter:	Poul Bak	Email Updates:
Status:	Closed	Impact on me:	None
Category:	Connector / NET	Severity:	S2 (Serious)
Version:	6.1.2	OS:	Any
Assigned to:	Vladislav Vaintroub	CPU Architecture:	Any
Tags:	MySqlSessionStateProvider

Description:
After installing and running MySqlSessionStateProvider I got an error saying that SessionState was corrupted.
It turns out that the data, I saved in Session vars, were truncated at 64 kb,
because you have chosen to use BLOB fields.
One of the main reasons to use MySqlSessionStateProvider instead of 'InProc' sessions is to save memory, so it seems wrong to limit sessions to 64 kb. That might have been a good choice 10 years ago, but today it's not. I think it's a wrong approach to create limitations that neither 'InProc' nor 'StateServer' have (I have not tried SqlServer, so I don't know if it has this limitation).

How to repeat:
Try to save a session var larger than 64 kb. When opening a new page, the provider will fail, saying the session data is corrupt (which is correct).

Suggested fix:
The fix is simple: Change the column's type to LONGBLOB !
Sure, each session will use 2 bytes more, so what?

Hi Poul and thanks for your report.

I searched all over .NET docs but Microsoft is not keen on revealing the limitations in stuff they make...
However, I found that there are URL length and header size restrictions enforced by http.sys and ASP.NET. Size of data sent in additional custom header can not exceed 65,535 bytes, for example.

Now, I am setting this to "Verified" so Reggie can confirm or overrule my findings. Also, it might be a good thing to put such limitations into our docs.

I have manually changed the coloumn's type to LONGBLOB and now I can save large values. So it seems it's only a limitation on the table you create.

As mentioned, both 'InProc' and 'StateServer' also allow large values, so it's not a limitation in Session itself.

Suggested fix still seems to be the right fix.

Poul, thanks!

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/83583

775 Vladislav Vaintroub	2009-09-17
      Bug#47339 MySqlSessionStateProvider truncates sessions at 64 kb.
      changed column definitionfor SessionItems to LONGBLOB instead of BLOB.

pushed in 6.1.2 and trunk

An entry was added to the 6.1.2 changelog:

The MySQL Connector/NET Session State Provider truncated session data to 64KB, due to its column types being set to BLOB.