Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:120764
MIME-Version: 1.0
Date: Fri, 7 Jul 2023 11:52:37 -0300
Message-ID: <CAEwRQKa4=AYbpPrkXoc_JNB_5dJY8ipuGM22VYGEL7d+k3jp3w@mail.gmail.com>
To: internals@lists.php.net
Content-Type: multipart/alternative; boundary="0000000000004844d405ffe6c956"
Subject: session_regenerate_id concurrency problems
From: carlosv775@gmail.com (Vinicius Dias)

--0000000000004844d405ffe6c956
Content-Type: text/plain; charset="UTF-8"

Hello, internals. I hope you all are well.

The documentation page for the `session_regenerate_id`[1] function has
the following warning:

> **Warning**
Currently, session_regenerate_id does not handle an unstable network
well, e.g. Mobile and WiFi network. Therefore, you may experience a
lost session by calling session_regenerate_id.
You should not destroy old session data immediately, but should use
destroy time-stamp and control access to old session ID. Otherwise,
concurrent access to page may result in inconsistent state, or you may
have lost session, or it may cause client(browser) side race condition
and may create many session ID needlessly. Immediate session data
deletion disables session hijack attack detection and prevention also.

Since the documentation states that this problem exists **currently**,
are there any plans to address it?

Thank you all in advance.

[1]: https://www.php.net/session_regenerate_id

--0000000000004844d405ffe6c956--