This week in caching: moving PHP sessions to Redis the safe way

This week in caching: moving PHP sessions to Redis the safe way

A migration checklist that avoids logging everyone out. Skip if you're stateless via JWT.

— Separate session DB from cache DB — use a different Redis numbered DB (or instance) so a FLUSHDB of your cache never dumps live sessions.
— Set persistence honestly — sessions need AOF or RDB; a pure-cache Redis with no persistence loses every login on restart.
— Match TTL to session.gc_maxlifetime — let Redis expire keys instead of PHP's GC probability lottery.
— Lock carefully — the Redis session handler locks per-session; long-running AJAX can serialize requests and feel like a hang. Set session.lock_expire.
— Drain, don't cut over — run both handlers during deploy or accept a mass logout.

Credit to Colin Mollenhour's php-redis-session-abstract docs for the locking gotchas.

Bookmark: the PHP session.save_handler=redis ini reference — the exact directives.