在nginx上将数据写入$ _SERVER

Question

For reasons that were not my own, I'm working with an application running on nginx that places a GET variable into PHP's $_SERVER global.

What happens is:

1. A user logs in with Facebook connect

2. Facebook passes back the user's session as a JSON encoded GET variable to a callback PHP script

3. An nginx rule places the GET variable into $_SERVER before the PHP script runs

4. The PHP script references the variable placed in $_SERVER and uses it to log the user into the site

Despite the fact that this is a bad solution in general, is writing user specific runtime data to a $_SERVER variable even safe on nginx? Would it create any concurrency issues when multiple users are logging into the site?

Answer 1

The $_SERVER variable is not shared between users. Each PHP instance has its own copy of the $_SERVER variable. It contains data pertaining to the current request, as such is request specific. You can write to it all you want without concerns, but it really isn't good practice to do so (there is a performance penalty when doing so and it's also rather unorthodox).
If the server is simply setting environment variables that show up in $_SERVER, that's an acceptable use though. Just don't write to it from your PHP scripts.