Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:69348
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.128.46 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAPwsocEwM_A3YraxZmJEXjBxaGgTZhfv711801bwtHLfJfNh+Q@mail.gmail.com>
References: <CAGa2bXbh6dOf41nZ0r-RuRtkCuuiA=r=SnxS+A1+GgqFXPGOWQ@mail.gmail.com>
	<CABBJUpdNr6McK6Q4qtztiYYG9CKZF7AeUdvo3YM+W0S87f8nDg@mail.gmail.com>
	<CAPwsocEwM_A3YraxZmJEXjBxaGgTZhfv711801bwtHLfJfNh+Q@mail.gmail.com>
Date: Thu, 26 Sep 2013 18:32:32 +0800
Message-ID: <CAHMUw2EQuT-y2Ho85QXhDdtysTWC=4FyY4nK9i-yR7qGqk6M=Q@mail.gmail.com>
To: Leigh <leight@gmail.com>
Cc: Laruence <laruence@php.net>, PHP Internals <internals@lists.php.net>, 
	Yasuo Ohgaki <yohgaki@ohgaki.net>
Content-Type: multipart/alternative; boundary=047d7b33d790376fa204e746e3a1
Subject: Re: [PHP-DEV] Regenerating session ID automatically when IP address
 has changed
From: tjerk.meesters@gmail.com (Tjerk Meesters)

--047d7b33d790376fa204e746e3a1
Content-Type: text/plain; charset=ISO-8859-1

Hi,


On Thu, Sep 26, 2013 at 6:19 PM, Leigh <leight@gmail.com> wrote:

> On Sep 24, 2013 3:43 AM, "Laruence" <laruence@php.net> wrote:
> >
> > I don't think this is language concerning issue.
> >
> > it could be done in user script..
> >
> > thanks
>
> I agree entirely with Laurence (and others). This shouldn't be a core
> feature. It's not one size fits all.
>
> There's several scenarios where a users IP changes and you don't want to
> drop their session. (That doesn't mean it should simply have an option to
> disable it either)
>

Let's be clear here: this won't happen (in most cases), because the client
will simply get a new cookie and the session will keep working; it's like
what you would implement if your user level goes from anonymous to logged
in and vice versa.


>
> Many people still have dynamic IP addresses for their home connections, but
> the group who would suffer the most would be mobile users. It's pretty
> frustrating to use most sites with a phone as it is, without being kicked
> off every time you switch between grps or hsdpa or whatever.
>

Aha! I'm glad that you brought up mobile devices, because for those it's
more likely that in certain cases the updated cookie is not received while
the server believes that it was; scenario: "I stepped into an elevator and
was disconnected when I got out.". This makes it an unattractive option to
have enabled by default.




-- 
--
Tjerk

--047d7b33d790376fa204e746e3a1--