Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:122543
Precedence: bulk
MIME-Version: 1.0
References: <CAGBsUrera8cVE5nW1H6bCSok+gOjpHCyqutaCewoXEtYju-8yA@mail.gmail.com>
 <gvsLDSENsS87LGXzp2ZHU3Zan2V-OVjzFJbT2yHDVj2N4xsv29gIyfTRMrloA25H4YoNauhS9DL9_4YM6fBthqSnC7AGnkoZk2X3CNptGow=@gpb.moe>
 <CAGBsUrecUD89R_AViHAGFNYLCewj7w=3Vb0VKbqbUzsRSZ9phA@mail.gmail.com>
In-Reply-To: <CAGBsUrecUD89R_AViHAGFNYLCewj7w=3Vb0VKbqbUzsRSZ9phA@mail.gmail.com>
Date: Sun, 3 Mar 2024 22:33:37 +0100
Message-ID: <CAGBsUre10H9=10v4Yeh_kBuFvoQF3e5RZSJmv+ehJD+WVn37OA@mail.gmail.com>
Subject: Re: [PHP-DEV] [RFC] [Discussion] Deprecate GET/POST sessions
To: PHP internals <internals@lists.php.net>
Cc: arokettu@outlook.com
Content-Type: text/plain; charset="UTF-8"
From: tekiela246@gmail.com (Kamil Tekiela)

Hi Anton,

> As I know some session-related middlewares force custom-only session_id
> handling by setting
>
>    use_cookies = Off
>    use_only_cookies = On
>
> and then using session_id(...) directly
>
> Example:
> https://github.com/middlewares/php-session/blob/master/src/PhpSession.php#L137

I was not aware that some frameworks do that. But I don't understand
how this works. IMHO if you disable the use of cookies, but you also
tell PHP to use only cookies it creates an impossible scenario. Isn't
that right?

The way I understand it is that there are 2 ways of propagating
session ID: cookies and GET/POST. You can tell PHP to use both or
either one of them, but not neither.

Only cookies:
use_only_cookies = On
use_cookies = On

Only GET/POST:
use_only_cookies = Off
use_cookies = Off

Both:
use_only_cookies = Off
use_cookies = On

The remaining 4th combination should create an impossible scenario.
Does it mean to use neither option?

I can change the proposal to deprecate only use_only_cookies=Off and
session.use_trans_sid=On and leave session.use_cookies alone, but I
just can't think of a situation when leaving that setting in PHP would
make sense.

I am probably missing something very important and I would appreciate
it if someone could explain to me what it is. I wouldn't want to
deprecate something that is used in popular frameworks.