Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:69338
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.214.176 as permitted sender)
MIME-Version: 1.0
Sender: dor.tchizik@gmail.com
In-Reply-To: <CAGa2bXaOKrU=UP1CENv1rb9B1bE4B7GMCaJNoiYsa3C5iA40HA@mail.gmail.com>
References: <CAGa2bXbh6dOf41nZ0r-RuRtkCuuiA=r=SnxS+A1+GgqFXPGOWQ@mail.gmail.com>
	<CALrkBjZNgkiSzXU86RKrLOBwKx1bQhT9oKmYiR324MGWOYWj=g@mail.gmail.com>
	<CAGa2bXaOKrU=UP1CENv1rb9B1bE4B7GMCaJNoiYsa3C5iA40HA@mail.gmail.com>
Date: Thu, 26 Sep 2013 00:49:15 +0200
Message-ID: <CAGbiJu9o9i5Kwd-q0LHLDPvrO35tYQSVMX8wnPsQu-gcUe_zvQ@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: Mike Willbanks <pencap@gmail.com>, "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [PHP-DEV] Regenerating session ID automatically when IP address
 has changed
From: madara@tchizik.com (Madara Uchiha)

Why couldn't this be implemented on userland again? I don't feel this
is a language level issue.

On Wed, Sep 25, 2013 at 8:55 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> Hi Mike,
>
> On Wed, Sep 25, 2013 at 2:16 PM, Mike Willbanks <pencap@gmail.com> wrote:
>
>> Each and every type of prevention measure has consequences and not only
>> that but MAJOR consequences.  If you are detecting IP changes you rule out
>> most if not all major proxy networks that exist.  While not first of mind;
>> when handling this you can easily remove the old session without properly
>> transitioning to the new.  This is an option based off of individual
>> application vs. a language option or construct.  There are a ton of
>> different measures that you might take based off of changes to the end user
>> data.  I think this would be a poor idea in the long run due to the
>> consequences that you may incur.
>
>
> The more I get this kind of response, the more I feel we should
> introduce this feature as session module optional feature.
>
> Regenerating session ID should not be any problem as long as
> session ID is cookie based, save handler lock session data while
> it is used.
>
> As far as I know, the only faulty save handler is mm save handler.
> (I would like to implement lock in mm, but it's low priority for me.
>  When TranSID is enabled, it would cause problems due to cached
>  pages.)
>
> The best practice of the session ID management is regenerating
> session ID when events happen. Mandatory one is login event.
> Web programmers must regenerate session ID to make sure
> session safety at login.
>
> IP address change is one of the event, even though it's not mandatory.
>
> There is PHP framework called Piece Framework that has option
> regenerate session ID for every request to achieve maximum
> session ID security, for example.
>
> If regeneration of session ID causes misbehavior, then it is a bug
> including users fault.
>
> I think if I disable this feature when TranSID on and/or expire is not 0,
> then there would not be issues. Unless web programmers use session
> ID for CSRF protection, etc.
>
> Anyway, I'll start from documentation.
> If there are any comments, I'll appreciate it.
>
> Regards,
>
> --
> Yasuo Ohgaki
> yohgaki@ohgaki.net