Every visitor that visits a WebGUI site is assigned a session ID. This tracks their usage of the site, allows them to customize things without logging in, and keeps track of what user account they've logged in to.

The most important bits are the session scratch and the userId. Without these, WebGUI would not be as we know it. These are the required functionality of a user session.

Less important is the "Last Page Viewed" or "User IP". These are easily figured out from any log analysis software, and more.

So, unless a user has set a scratch variable, or has logged in, there is no reason for them to have a session ID.

If they do not have a session ID, we have an excellent marker for caching proxies like nginx. We can improve performance for the Visitor user by making ALL requests bypass the mod_perl server.

Moreover, by removing last IP and last page viewed from the session, we remove the database writes needed to keep those current.

My question then is:

Does anyone absolutely need Last IP and Last Page Viewed to be tied to Session? Does anyone absolutely need every user to have a sessionId no matter what?

If so, I can make the old behavior an option (you can turn it on, it will be off by default).

The User's IP address is used all over WebGUI.  Here's a short list returned by

ack getIp
ack lastIp

1. Group's that use IP addresses to include users in groups.
2. Posts and Posts block repeated ratings from the same IP.
3. Subnet checks are done for Turn On Admin, Spectre, Showing Debug.

Now, 2 and 3 can pull the IP address directly from the request, so that's probably not a big deal, so that just leaves how to pull lists of users who are in IP groups.  And that can be an enablable feature.