Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:59199
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.213.170 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
Date: Thu, 29 Mar 2012 18:13:51 +0900
Message-ID: <CAGa2bXaeWwACOysdkQx4M7Y1DzwCKCH=1v9AWrD4MYCHd5yfYQ@mail.gmail.com>
To: internals@lists.php.net
Content-Type: text/plain; charset=ISO-8859-1
Subject: session.use_cookies and session.use_only_cookies
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi,

While I was testing strict session, I noticed that there
is a problem in current session module behavior.

From the manual
----
session.use_cookies specifies whether the module will use cookies to
store the session id on the client side. Defaults to 1 (enabled).

session.use_only_cookies specifies whether the module will only use
cookies to store the session id on the client side. Enabling this
setting prevents attacks involved passing session ids in URLs. This
setting was added in PHP 4.3.0. Defaults to 1 (enabled) since PHP
5.3.0.
----

When "session.use_only_cookie=off", "session.use_trans_sid=on"
should be effective.

However, to make "session.use_trans_sid=on" effective, PHP 5.4
(maybe 5.3, too) requires "session.use_cookie=off". This behavior
makes "session.use_only_cookie" setting useless.

Since cookie is mandatory for secure web applications, this behavior
is not good for applications that need both cookie and URL based
session, too.

There are many mobile devices that do not support cookie still, so I
would like to fix this issue.

Is there any comment?

--
Yasuo Ohgaki
yohgaki@ohgaki.net