Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:69760
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.223.172 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAJ26g5QH4j3K2peF7rGO-2uO_mjBK4kQELXCBQVXJOe9A7UEsw@mail.gmail.com>
References: <CAGa2bXbNFb0tV+Xqavz9m62RDxobey3BmyN0L7g9ATFxMS_KBA@mail.gmail.com>
	<CAH-PCH7TbexgCAVphaC_H8AF-V5UfNysy863Gq1sOzkxgQ01XA@mail.gmail.com>
	<CAJ26g5QH4j3K2peF7rGO-2uO_mjBK4kQELXCBQVXJOe9A7UEsw@mail.gmail.com>
Date: Tue, 22 Oct 2013 13:16:56 +0200
Message-ID: <CAH-PCH5OtzWfof92yP0+qk4Oops8YV8n=cu1db+5EQRFPcMG_A@mail.gmail.com>
To: Patrick Schaaf <bof@bof.de>
Cc: internals <internals@lists.php.net>, Yasuo Ohgaki <yohgaki@ohgaki.net>
Content-Type: multipart/alternative; boundary=047d7b10c853da489d04e95289ab
Subject: Re: [PHP-DEV] session_regenerate_id(true) by default
From: tyra3l@gmail.com (Ferenc Kovacs)

--047d7b10c853da489d04e95289ab
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Tue, Oct 22, 2013 at 1:10 PM, Patrick Schaaf <bof@bof.de> wrote:

>
> Am 22.10.2013 12:48 schrieb "Ferenc Kovacs" <tyra3l@gmail.com>:
>
> > We could we add an E_DEPRECATED for the session_regenerate_id(false)
> usage
> > for 5.6 instead.
>
> I might find that useful for the session_regenerate_id() case, i.e. when
> using the default, but IMHO there are perfectly valid reasons to keep the
> previous session active in a controlled way.
>
> Working on the issue for our own application, I'm in the process of
> teaching our session wrapping class to regenerate ID often - but when doi=
ng
> so, first setting up the previous session ID with two pieces of
> information: a short timeout of 20 seconds or something like that, and a
> "forwarding ID" which references the new session ID.
>
> I want to do this because I want to regenerate IDs often (also based on a
> rather short timeout), and I'm concerned about parallel in-flight request=
s
> - a high probability reality with ajax getting more and more traction -
> still presenting the old session ID a second or two after a request
> determined to regenerate.
>
> BTW and a bit off-topic: is there a good reason for session_write_close
> not returning a success indicator? Right now it spams the log with a
> misleading message, but gives me no chance (short of setting up a global
> error handler to catch and handle that message) to see (and maybe retry /
> use a fallback) on failure
>
> best regards
>   Patrick
>
you could do @session_write_close() and error_get_last() instead of the
global handler, but I think that it is a good idea and would be a trivial
and backward compatible change.


--=20
Ferenc Kov=C3=A1cs
@Tyr43l - http://tyrael.hu

--047d7b10c853da489d04e95289ab--