Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:122551
Message-ID: <93d8b10f-76d7-458f-b85a-f28ae934445d@vivaldi.net>
Date: Mon, 4 Mar 2024 18:21:16 +0200
User-Agent: Mozilla Thunderbird
Subject: Re: [PHP-DEV] [RFC] [Discussion] Deprecate GET/POST sessions
Content-Language: en-US
To: PHP internals <internals@lists.php.net>
References: <CAGBsUrera8cVE5nW1H6bCSok+gOjpHCyqutaCewoXEtYju-8yA@mail.gmail.com>
 <gvsLDSENsS87LGXzp2ZHU3Zan2V-OVjzFJbT2yHDVj2N4xsv29gIyfTRMrloA25H4YoNauhS9DL9_4YM6fBthqSnC7AGnkoZk2X3CNptGow=@gpb.moe>
 <CAGBsUrecUD89R_AViHAGFNYLCewj7w=3Vb0VKbqbUzsRSZ9phA@mail.gmail.com>
 <CAGBsUre10H9=10v4Yeh_kBuFvoQF3e5RZSJmv+ehJD+WVn37OA@mail.gmail.com>
In-Reply-To: <CAGBsUre10H9=10v4Yeh_kBuFvoQF3e5RZSJmv+ehJD+WVn37OA@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk
From: sandfox@vivaldi.net (Anton Smirnov)


On 03/03/2024 23:33, Kamil Tekiela wrote:
 > Hi Anton,
 >
 >> As I know some session-related middlewares force custom-only session_id
 >> handling by setting
 >>
 >>     use_cookies = Off
 >>     use_only_cookies = On
 >>
 >> and then using session_id(...) directly
 >>
 >> Example:
 >> 
https://github.com/middlewares/php-session/blob/master/src/PhpSession.php#L137
 >
 > I was not aware that some frameworks do that. But I don't understand
 > how this works. IMHO if you disable the use of cookies, but you also
 > tell PHP to use only cookies it creates an impossible scenario. Isn't
 > that right?
 >
 > The way I understand it is that there are 2 ways of propagating
 > session ID: cookies and GET/POST. You can tell PHP to use both or
 > either one of them, but not neither.
 >
 > Only cookies:
 > use_only_cookies = On
 > use_cookies = On
 >
 > Only GET/POST:
 > use_only_cookies = Off
 > use_cookies = Off
 >
 > Both:
 > use_only_cookies = Off
 > use_cookies = On
 >
 > The remaining 4th combination should create an impossible scenario.
 > Does it mean to use neither option?
 >
 > I can change the proposal to deprecate only use_only_cookies=Off and
 > session.use_trans_sid=On and leave session.use_cookies alone, but I
 > just can't think of a situation when leaving that setting in PHP would
 > make sense.
 >
 > I am probably missing something very important and I would appreciate
 > it if someone could explain to me what it is. I wouldn't want to
 > deprecate something that is used in popular frameworks.

Hi Kamil

The remaining 4th combination creates the situation when session 
creation is always a responsibility of the userland code.
(by using session_id($id))

In the link I provided it is done by PSR-7/15 purists that think that 
only the request emitter should handle headers, not PHP itself and it 
includes cookie headers.

For non-purists it is still a useful scenario, for example it allowed to 
use SameSite attribute on a session cookie before PHP 7.3