Is it reasonable to store sessions in a database?

Question

PHP

I'm learning php, in particular user authentication / authorization, and I thought about this question. The commonly accepted method of authorization seems to be sessions. By default, sessions are stored in files on disk. Different sources on the Internet have different opinions about whether this is good or bad ... someone thinks that this is a standard solution and therefore good; someone points out potential security and performance issues. It also mentions a multi-server organization, something with file locks (I haven’t figured it out yet), etc.
But I'm interested in the following. I would like to display a list of online users and generally have access to which users are online now and when they last accessed the site. Obviously, to do this, you can simply enter the time of the last access into the user table ... (by the way, this can be stored both in the mysql database and in some kind of fast key-value storage). This can be linked to sessions, but you can not link it. The tasks are very close, so the question is: how would you do it and why?

Answer 1

Sessions and the list of online users are somehow not connected, in order to show the list of online users, you need to update the last call to the server, and then you can display online for the last 15 minutes (in VK it seems like this).
And sessions - they are stored on the server and there is no access to them from the outside, and if they get access to it, then I suppose they will also get access to the database, so the security issue is the same here)

Answer 2

It depends on the load. It depends on your capabilities (can you configure the server for yourself as it should).
I would store sessions in Tarantool. This is such an In-Memory DBMS that flushes to disk.
It was created in Mail.RU primarily for storing sessions.

Answer 3

potential security and performance issues

It's petty, and what is usually written by programmers is much more dangerous.
Would store session IDs in the database. You also mean it under "storage of sessions in a DB"?
If yes, then it is advisable if the functionality of the site requires it. It is quite possible to identify unlogged users by session, and thus store, based on the session, a list of goods in the basket, or, in your case, the last call to the server.
In the case of logged in users, I don’t see much point in storing sessions in the database.
If not, then it's pointless 99% of the time for the reasons noted above.