Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:102948
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.214.46 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAJd4=YZfMgJ7pLwUx_0GqdV+KMCGqYZFhQEDV_2KTMOKiRi6dA@mail.gmail.com>
References: <a4189866-23ea-4dc5-12a4-a7fbad8e5601@genkgo.nl>
 <1abd260d-ebc4-a062-3381-72485946e8bc@gmail.com> <a55b37e3-268c-f8ab-6545-6cf7a4f537f0@genkgo.nl>
 <CAJd4=Ya67XaX3bwwQn20GUQqEvEVe8XEepRz9+of6h4t4fC_fg@mail.gmail.com>
 <CAPhkiZzSfwMd7TthF7jcWwY+JTnFyamyevnWDZZhGGF_qpEpKA@mail.gmail.com> <CAJd4=YZfMgJ7pLwUx_0GqdV+KMCGqYZFhQEDV_2KTMOKiRi6dA@mail.gmail.com>
Date: Sun, 22 Jul 2018 10:42:59 +0200
Message-ID: <CAF+90c97-=zx5tbs1CFg5wzhaOij=Lr_wHnPni06P3zB6F1uYA@mail.gmail.com>
To: =?UTF-8?Q?Pedro_Magalh=C3=A3es?= <mail@pmmaga.net>
Cc: Andrey Andreev <narf@devilix.net>, f.bosch@genkgo.nl, 
	Stanislav Malyshev <smalyshev@gmail.com>, PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="0000000000002c652f0571928461"
Subject: Re: [PHP-DEV] [VOTE] Same Site Cookie RFC
From: nikita.ppv@gmail.com (Nikita Popov)

--0000000000002c652f0571928461
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Sun, Jul 22, 2018 at 1:21 AM, Pedro Magalh=C3=A3es <mail@pmmaga.net> wro=
te:

> On Sat, Jul 21, 2018 at 11:26 PM Andrey Andreev <narf@devilix.net> wrote:
>
> > Yes.
> >
> > All other "options" are actual *cookie attribute* names, as defined by
> > the various IETF RFCs, while "lifetime" is just a convenient name used
> > by PHP. It doesn't correspond to a particular attribute, but instead
> > the values for the Expires and Max-Age attributes are derived from it.
> > I believe during discussion I insisted that the parameter be called
> > "attributes", for this very reason.
> >
>
> Hi,
>
> While I do understand your reasoning, I find it extremely unfriendly to t=
he
> user of the function to ask for one parameter separate from all the other=
s
> for that reason alone.
> Also, keep in mind that all this function does is set the
> `session.cookie_*` ini entries. So all parameters are treated equally.
>

To add to this, session_get_cookie_params() already returns all parameters
including "lifetime" in one array. It would be very weird if there was an
asymmetry between session_get_cookie_params() and
session_set_cookie_params().

Furthermore, the way I have seen session_set_cookie_params() used, it has
pretty much always been in conjunction with a prior
session_get_cookie_params() call to get the current values and then only
one (or some) of them being adjusted. It makes more sense to write

$params =3D session_get_cookie_params();
// Change $params here
session_set_cookie_params($params);

than having to treat just the $params["lifetime"] case specially.

Nikita

> On another note, I also wanted that pretty much any key/value pair to
> > be accepted instead of raising an error, for forward compatibility.
> >
>
> I really believe that the user spotting errors like `['expries' =3D> time=
() +
> 3600]` faster is more valuable than FC.
>
> Regards,
> Pedro
>

--0000000000002c652f0571928461--