Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:69333
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.182 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CALrkBjZNgkiSzXU86RKrLOBwKx1bQhT9oKmYiR324MGWOYWj=g@mail.gmail.com>
References: <CAGa2bXbh6dOf41nZ0r-RuRtkCuuiA=r=SnxS+A1+GgqFXPGOWQ@mail.gmail.com>
 <CALrkBjZNgkiSzXU86RKrLOBwKx1bQhT9oKmYiR324MGWOYWj=g@mail.gmail.com>
Date: Wed, 25 Sep 2013 14:55:57 +0900
Message-ID: <CAGa2bXaOKrU=UP1CENv1rb9B1bE4B7GMCaJNoiYsa3C5iA40HA@mail.gmail.com>
To: Mike Willbanks <pencap@gmail.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a1133f726a0bcc904e72eeae7
Subject: Re: [PHP-DEV] Regenerating session ID automatically when IP address
 has changed
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a1133f726a0bcc904e72eeae7
Content-Type: text/plain; charset=UTF-8

Hi Mike,

On Wed, Sep 25, 2013 at 2:16 PM, Mike Willbanks <pencap@gmail.com> wrote:

> Each and every type of prevention measure has consequences and not only
> that but MAJOR consequences.  If you are detecting IP changes you rule out
> most if not all major proxy networks that exist.  While not first of mind;
> when handling this you can easily remove the old session without properly
> transitioning to the new.  This is an option based off of individual
> application vs. a language option or construct.  There are a ton of
> different measures that you might take based off of changes to the end user
> data.  I think this would be a poor idea in the long run due to the
> consequences that you may incur.


The more I get this kind of response, the more I feel we should
introduce this feature as session module optional feature.

Regenerating session ID should not be any problem as long as
session ID is cookie based, save handler lock session data while
it is used.

As far as I know, the only faulty save handler is mm save handler.
(I would like to implement lock in mm, but it's low priority for me.
 When TranSID is enabled, it would cause problems due to cached
 pages.)

The best practice of the session ID management is regenerating
session ID when events happen. Mandatory one is login event.
Web programmers must regenerate session ID to make sure
session safety at login.

IP address change is one of the event, even though it's not mandatory.

There is PHP framework called Piece Framework that has option
regenerate session ID for every request to achieve maximum
session ID security, for example.

If regeneration of session ID causes misbehavior, then it is a bug
including users fault.

I think if I disable this feature when TranSID on and/or expire is not 0,
then there would not be issues. Unless web programmers use session
ID for CSRF protection, etc.

Anyway, I'll start from documentation.
If there are any comments, I'll appreciate it.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a1133f726a0bcc904e72eeae7--