Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:117745
Message-ID: <5b866dcf-cbc7-4441-362b-3fa2c735dd8f@gmx.de>
Date: Wed, 18 May 2022 19:43:28 +0200
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101
 Thunderbird/91.9.0
Content-Language: de-DE
To: Craig Francis <craig@craigfrancis.co.uk>, Mark Randall <marandall@php.net>
Cc: internals@lists.php.net
References: <CA+XhMqw0YmvwXh_pyQgFZcWC1kO7yBrF5pkAhSzB_eHbABFnUw@mail.gmail.com>
 <62841d87.1c69fb81.82a5.8a18SMTPIN_ADDED_MISSING@mx.google.com>
 <9272E23F-F962-4023-B62D-7A70EA08E828@craigfrancis.co.uk>
 <628518bb.1c69fb81.1deb1.1bd5SMTPIN_ADDED_MISSING@mx.google.com>
 <86A3AC49-1F82-423A-9E66-B334E947E53B@craigfrancis.co.uk>
In-Reply-To: <86A3AC49-1F82-423A-9E66-B334E947E53B@craigfrancis.co.uk>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] Early feedback on encrypted session PR
From: cmbecker69@gmx.de ("Christoph M. Becker")

On 18.05.2022 at 18:37, Craig Francis wrote:

> On 18 May 2022, at 17:02, Mark Randall <marandall@php.net> wrote:
>
>> Personally I usually just throw the session key through a one-way hash =
so the original session ID never gets written to a backing store.
>
> Good idea, but that's not done by default.

But also not by the PR, as I understand it.

>> I'm not sure why reversible encryption needs to take place?
>
> It might provide privacy (if the attacker can read the session files, an=
d they contain sensitive information, e.g. some developers store a copy of=
 the users entire record in the session to avoid db lookups)... and it mig=
ht prevent edits being made to the session file.

It is already possible to write an own SessionHandler which
encrypts/decrypts the session payload.  That said, I'm not against
adding an encryption option.

> I would hope both are very rare, but I'm still writing up reports about =
developers doing things like `file_put_contents('/tmp/' . $_POST['id'], $_=
POST['message'])`, so I don't have a lot of hope.

Right.  And no amount of magic features implemented by a language or
library will prevent such issues completely.  It might not have been the
best idea to make PHP so beginner friendly.

=2D-
Christoph M. Becker