Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:15702
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Message-ID: <5.1.0.14.2.20050331192156.06ec0a90@localhost>
Date: Thu, 31 Mar 2005 19:24:46 +0200
To: Hans L <hans@velum.net>
Cc: PHP internals <internals@lists.php.net>
In-Reply-To: <424994B1.3000600@velum.net>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format=flowed
Subject: Re: [PHP-DEV] why does PHP accept [new] session ids from
	client?
From: zeev@zend.com (Zeev Suraski)
References: <424994B1.3000600@velum.net>

At 19:47 29/03/2005, Hans L wrote:
>Hi,
>
>This may not be the right place for this question, but what I'm looking to 
>understand is the reasoning behind what seems to be the standard session 
>behavior in PHP.  And, if it's possible, how to change this behavior (via 
>INI settings, etc.).
>
>As I understand (and experience) it, if a client [browser] presents a 
>session id (e.g. in a cookie) to the server, then PHP will attempt to 
>match that ID to the session on the system.  If found, that session 
>information will be made available to the scripts.  Fine.  But, if *not 
>found* then a new session will be created with the specified ID.
>
>Is there any way to disable this behavior?  I can't think of a single 
>circumstance under which this would be the desired behavior, but my use of 
>sessions has been more limited to authentication & web applications.

I actually came across one situation where I took advantage of this feature 
and relied on it in an application.  It had to do with replicating parts of 
a session across a cluster of servers (also for use in authentication).

Zeev