Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:15661
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Message-ID: <424994B1.3000600@velum.net>
Date: Tue, 29 Mar 2005 12:47:29 -0500
User-Agent: Mozilla Thunderbird 1.0 (Windows/20041206)
MIME-Version: 1.0
To: PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: why does PHP accept [new] session ids from client?
From: hans@velum.net (Hans L)

Hi,

This may not be the right place for this question, but what I'm looking 
to understand is the reasoning behind what seems to be the standard 
session behavior in PHP.  And, if it's possible, how to change this 
behavior (via INI settings, etc.).

As I understand (and experience) it, if a client [browser] presents a 
session id (e.g. in a cookie) to the server, then PHP will attempt to 
match that ID to the session on the system.  If found, that session 
information will be made available to the scripts.  Fine.  But, if *not 
found* then a new session will be created with the specified ID.

Is there any way to disable this behavior?  I can't think of a single 
circumstance under which this would be the desired behavior, but my use 
of sessions has been more limited to authentication & web applications. 
  I know about using session_regenerate_id() after authentication, to 
prevent fixation, but it seems like this is a workaround for a more 
fundamental problem in PHP session behavior.

On a side note, does anyone know if Hardened-PHP exhibits the same behavior?

Thanks,
Hans