diff --git a/session.md b/session.md index 5dd8841d4e8..e9981515213 100644 --- a/session.md +++ b/session.md @@ -206,12 +206,16 @@ Laravel automatically regenerates the session ID during authentication if you ar By default, Laravel allows requests using the same session to execute concurrently. So, for example, if you use a JavaScript HTTP library to make two HTTP requests to your application, they will both execute at the same time. For many applications, this is not a problem; however, session data loss can occur in a small subset of applications that make concurrent requests to two different application endpoints which both write data to the session. -To mitigate this, Laravel provides functionality that allows you to limit concurrent requests for a given session. To get started, you may simply chain the `block` method onto your route definition: +To mitigate this, Laravel provides functionality that allows you to limit concurrent requests for a given session. To get started, you may simply chain the `block` method onto your route definition. In this example, an incoming request to the `/profile` endpoint would acquire a session lock. While this lock is being held, any incoming requests to the `/profile` or `/order` endpoints which use the same session will wait for the first request to finish executing before continuing their execution: Route::post('/profile', function () { ... })->block($lockSeconds = 10, $waitSeconds = 10) + Route::post('/order', function () { + ... + })->block($lockSeconds = 10, $waitSeconds = 10) + The `block` method accepts two optional arguments. The first argument accepted by the `block` method is the maximum number of seconds the session lock should be held for before it is released. Of course, if the request finishes executing before this time the lock will be released earlier. The second argument accepted by the `block` method is the number of seconds a request should wait while attempting to obtain a session lock. A `Illuminate\Contracts\Cache\LockTimoutException` will be thrown if the request is unable to obtain a session lock within the given number of seconds.