为什么在几乎在执行ajax get请求的同时发布数据时，不会保存php会话数据？

Question

Using a html element for search, my search allows GET and POST requests. I am sending the pressed keys using ajax GET for live search (timeout 750ms) and when the form is submitted, the string is POSTED.

The problem is that new session data is not saved when the ajax request and the form is submitted at the same time.

I found two solutions to this problem but they seem to mask the real problem. First solution is to stop the ajax request when enter is pressed using javascript if ((event.keyCode || event.which) == 13) and 2nd solution is calling session_write_close() and session_start() right after new session data is saved.

Can you explain why some session data is not saved (while others are properly saved during same request) when ajax GET is executed while a html form is in the middle of being posted or else explain the need for calling session_write_close and session_start to make sure session data is saved during critical operations like checking CSRF: generate new token if post is valid and save this in session?

Example code:

PHP Wrapper for storing new key:

public function setCsrfKey($property)
{
    $_SESSION['x']['CsrfKey'] = (string) $property; 
}

JS code:

$(searchBox).on("keyup", function(e){
    e.stopPropagation();
    clearTimeout(ajaxTimeOut);

    var keyPressed = e.keyCode || e.which;

    var string = $(this).val();

    if (string.length < 3) {
        queueList.clearQueue('ajaxCall');

        return;
    }

    queueList.queue('ajaxCall', function(){
        $.ajax({
            url: urlString,
            type: 'GET',
        }).done (function( data ) {
        }).fail (function(){
        });
    });

    ajaxTimeOut = setTimeout( function(){
        while (queueList.queue('ajaxCall').length > 1) {
            queueList.queue('ajaxCall').shift();
        }
        queueList.dequeue('ajaxCall');
    }, 750);

});

Answer 1

PHP writes session data when the script ends unless you tell it otherwise (with session_write_close). What happens with two simultaneous requests in the same session depends on your session handler...but if the request is allowed to happen, the two requests typically won't see each other's changes to the session, and one's changes will generally get lost.

Calling session_write_close saves the session so that future requests will use the updated session. It's a bit of a hack; what you have here is a race condition, and there's still a chance of stuff breaking. It'll just be a lot lower the sooner you can commit your changes to the disk/database/whatever. Lower still if you can insert a short delay between requests as well.

Of course, once you've closed the session, it won't get saved when the script ends, so nothing else will get added to it. You have to call session_start() to reopen it if you want to make further changes to it.