Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:117751
MIME-Version: 1.0
References: <CA+XhMqw0YmvwXh_pyQgFZcWC1kO7yBrF5pkAhSzB_eHbABFnUw@mail.gmail.com>
 <62841d87.1c69fb81.82a5.8a18SMTPIN_ADDED_MISSING@mx.google.com>
 <9272E23F-F962-4023-B62D-7A70EA08E828@craigfrancis.co.uk> <628518bb.1c69fb81.1deb1.1bd5SMTPIN_ADDED_MISSING@mx.google.com>
 <86A3AC49-1F82-423A-9E66-B334E947E53B@craigfrancis.co.uk> <5b866dcf-cbc7-4441-362b-3fa2c735dd8f@gmx.de>
In-Reply-To: <5b866dcf-cbc7-4441-362b-3fa2c735dd8f@gmx.de>
Date: Wed, 18 May 2022 21:37:23 +0100
Message-ID: <CA+XhMqzQ5KgAMM8CfmbVE8UDQWdy9o-LWY8PtGPC4v+qu_o_8w@mail.gmail.com>
To: "Christoph M. Becker" <cmbecker69@gmx.de>
Cc: Craig Francis <craig@craigfrancis.co.uk>, Mark Randall <marandall@php.net>, internals@lists.php.net
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] Early feedback on encrypted session PR
From: devnexen@gmail.com (David CARLIER)

Thanks all for the early feedback.

So it is an attempt to mitigate tampering attacks basically on session
stored on filesystems. So it appears to be a subset of session usage
overall indeed but
doing so in a native manner is what drove the PR.

On Wed, 18 May 2022 at 18:43, Christoph M. Becker <cmbecker69@gmx.de> wrote=
:
>
> On 18.05.2022 at 18:37, Craig Francis wrote:
>
> > On 18 May 2022, at 17:02, Mark Randall <marandall@php.net> wrote:
> >
> >> Personally I usually just throw the session key through a one-way hash=
 so the original session ID never gets written to a backing store.
> >
> > Good idea, but that's not done by default.
>
> But also not by the PR, as I understand it.
>
> >> I'm not sure why reversible encryption needs to take place?
> >
> > It might provide privacy (if the attacker can read the session files, a=
nd they contain sensitive information, e.g. some developers store a copy of=
 the users entire record in the session to avoid db lookups)... and it migh=
t prevent edits being made to the session file.
>
> It is already possible to write an own SessionHandler which
> encrypts/decrypts the session payload.  That said, I'm not against
> adding an encryption option.
>
> > I would hope both are very rare, but I'm still writing up reports about=
 developers doing things like `file_put_contents('/tmp/' . $_POST['id'], $_=
POST['message'])`, so I don't have a lot of hope.
>
> Right.  And no amount of magic features implemented by a language or
> library will prevent such issues completely.  It might not have been the
> best idea to make PHP so beginner friendly.
>
> --
> Christoph M. Becker
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: https://www.php.net/unsub.php
>