Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:117742
Content-Type: text/plain;
	charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3696.80.82.1.1\))
In-Reply-To: <62841d87.1c69fb81.82a5.8a18SMTPIN_ADDED_MISSING@mx.google.com>
Date: Wed, 18 May 2022 16:23:49 +0100
Cc: internals@lists.php.net
Content-Transfer-Encoding: quoted-printable
Message-ID: <9272E23F-F962-4023-B62D-7A70EA08E828@craigfrancis.co.uk>
References: <CA+XhMqw0YmvwXh_pyQgFZcWC1kO7yBrF5pkAhSzB_eHbABFnUw@mail.gmail.com>
 <62841d87.1c69fb81.82a5.8a18SMTPIN_ADDED_MISSING@mx.google.com>
To: Mark Randall <marandall@php.net>
Subject: Re: [PHP-DEV] Early feedback on encrypted session PR
From: craig@craigfrancis.co.uk (Craig Francis)

On 17 May 2022, at 23:11, Mark Randall <marandall@php.net> wrote:
> On 17/05/2022 21:36, David CARLIER wrote:
>> I wanted a more general but early feedback on the idea itself
>> https://github.com/php/php-src/pull/3759
>=20
> What is the motivation? What is it meant to achieve?


If the Session ID continued to work as the Identifier, but the client =
was given the Session ID and a Random Key (could be concatenated =
together for the cookie)... that means the Random Key would not be =
stored on the server, and could protect the session if there was a =
vulnerability on the server/website (e.g. attacker being able to see the =
directory listing of session files)... I'm not sure how much of a =
benefit that will actually provide, vs the risk of it going wrong (e.g. =
future PHP changing encryption algorithm).

Craig