Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:121762
MIME-Version: 1.0
Date: Wed, 22 Nov 2023 18:05:46 -0300
Message-ID: <CADK1yX+2DWPyRBvGh2bJdn+3ZfdgN0-kX5NaDuTfvMhioExF+A@mail.gmail.com>
To: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="0000000000005dd71e060ac41746"
Subject: Ability to session_decode() in a stateless manner?
From: deleugyn@gmail.com (Deleu)

--0000000000005dd71e060ac41746
Content-Type: text/plain; charset="UTF-8"

Hi!

Earlier today I was working on a small tool to invalidate PHP Sessions in a
legacy system. I quickly found out about the `session_decode()` function,
but unfortunately this function requires an active session and it is
completely stateful, which means when I try to decode a specific session
data, I end up overriding the existing session.

I also tried combining `ob_start()` with `session_id()`, `session_start()`,
`session_destroy()` and `ob_end_clean()`, but this would still cause some
weird behaviors by sending two PHP Cookies through the Response Headers.

In an ideal world, I would override `session.serialize_handler` and be done
with it, but that would require invalidating every existing session and
some non-trivial changes in the 20 year old codebase.

To my original question, is there any exposed API that would give userland
access to the session deserializer algorithm in a stateless manner?
Something like `session_deserialize(string $data): array;`, preferably in a
way that
1) doesn't require or doesn't conflict with any existing session and
2) returns the session array without any side effects?

If not, would this be something that requires an RFC? Are there any
controversial thoughts around it?

Thanks!

-- 
Marco Deleu

--0000000000005dd71e060ac41746--