Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:69362 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 72233 invoked from network); 26 Sep 2013 22:59:13 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 26 Sep 2013 22:59:13 -0000 Authentication-Results: pb1.pair.com header.from=swhitemanlistens-software@cypressintegrated.com; sender-id=pass Authentication-Results: pb1.pair.com smtp.mail=swhitemanlistens-software@cypressintegrated.com; spf=pass; sender-id=pass Received-SPF: pass (pb1.pair.com: domain cypressintegrated.com designates 173.1.104.101 as permitted sender) X-PHP-List-Original-Sender: swhitemanlistens-software@cypressintegrated.com X-Host-Fingerprint: 173.1.104.101 rproxy2-b-iv.figureone.com Windows 2000 SP2+, XP SP1 (seldom 98 4.10.2222) Received: from [173.1.104.101] ([173.1.104.101:57748] helo=rproxy2-b-iv.figureone.com) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id 88/C6-37010-F3CB4425 for ; Thu, 26 Sep 2013 18:59:12 -0400 Received: from localhost ([216.220.114.66]) by rproxy2-b-iv.figureone.com (Brand New Heavy v1.0) with ASMTP id LFH22409 for ; Thu, 26 Sep 2013 15:59:09 -0700 Date: Thu, 26 Sep 2013 18:57:52 -0400 Reply-To: Sanford Whiteman X-Priority: 3 (Normal) Message-ID: <1417591323.20130926185752@cypressintegrated.com> To: Yasuo Ohgaki In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Subject: Re: [PHP-DEV] Regenerating session ID automatically when IP address has changed From: swhitemanlistens-software@cypressintegrated.com (Sanford Whiteman) > Users who are concerned for this situation should disable it. Users > who are concerned security should accept this case. I assume "users" are as we understand them here, i.e. me. But as a developer-user I would likely want to empower my end-users to turn off this feature themselves. With high-volume sites (not that I really have any anymore, but a guy can dream) there isn't going to be a one-size-fits-all regarding connection quality, but there can be a default INI setting and then a function that we can call to override it. Paranoid users will turn/leave it on.... any user in a sketchy connection situation will turn it off (per session or for all their future sessions). Which is kind of why this is sounding more and more like a nice discussion... about a userland solution. -- S.