Repository navigation
Stateless guests with on-demand sessions - #6721
Merged
Merged
Conversation
dtdesign
force-pushed
the
63-stateless-guest
branch
from
September 30, 2026 16:47
61d783c to
323fa48
Compare
dtdesign
marked this pull request as ready for review
September 30, 2026 20:45
…ing background queue checks in-request
…tcha question tokens
… on-demand guest sessions are enabled
…accept same-origin requests from sessionless guests
…TmpHashIdentifier()
…d for dead sessions
… stale questions as invalid
…token instead of the session
…ting anyone from deleting them
…act files without a token record claimed
dtdesign
force-pushed
the
63-stateless-guest
branch
from
October 1, 2026 12:03
a3a8515 to
33da0b0
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is a bit different to the original approach outlined in the issue because we went with a slightly different path that should work as a drop-in replacement for the current system. Sessions are deferred up until a point where they are actually required so that we can get away with omitting them until then.
Also, the behavior is currently an opt-in feature that is not enabled by default so that site owners can adjust it in case there are corner cases that we haven't covered.
The only drawback so far is that guests and search engines will vanish from the users online list which is actually a good thing. The list is notoriously unreliable because it is extremely inaccurate as soon as a bot sends no cookies. This means that 1 bot with cookies can send 100 requests but only counts as 1 visitor, but a cookie-less bot with 100 requests will show as 100 guests, although the caused the exact same amount of requests.
Closes #5928