Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:69792
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.180 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAJ26g5QH4j3K2peF7rGO-2uO_mjBK4kQELXCBQVXJOe9A7UEsw@mail.gmail.com>
References: <CAGa2bXbNFb0tV+Xqavz9m62RDxobey3BmyN0L7g9ATFxMS_KBA@mail.gmail.com>
 <CAH-PCH7TbexgCAVphaC_H8AF-V5UfNysy863Gq1sOzkxgQ01XA@mail.gmail.com> <CAJ26g5QH4j3K2peF7rGO-2uO_mjBK4kQELXCBQVXJOe9A7UEsw@mail.gmail.com>
Date: Wed, 23 Oct 2013 09:56:03 +0900
Message-ID: <CAGa2bXZRD_DKvrXy1gdesxbnNK+n8vVKT1K=P4ocU=m9aZMX2A@mail.gmail.com>
To: Patrick Schaaf <bof@bof.de>
Cc: Ferenc Kovacs <tyra3l@gmail.com>, internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=089e011769159ec4a604e95dfdcf
Subject: Re: [PHP-DEV] session_regenerate_id(true) by default
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--089e011769159ec4a604e95dfdcf
Content-Type: text/plain; charset=UTF-8

Hi Patrick,

On Tue, Oct 22, 2013 at 8:10 PM, Patrick Schaaf <bof@bof.de> wrote:

> Working on the issue for our own application, I'm in the process of
> teaching our session wrapping class to regenerate ID often - but when doing
> so, first setting up the previous session ID with two pieces of
> information: a short timeout of 20 seconds or something like that, and a
> "forwarding ID" which references the new session ID.
>
> I want to do this because I want to regenerate IDs often (also based on a
> rather short timeout), and I'm concerned about parallel in-flight requests
> - a high probability reality with ajax getting more and more traction -
> still presenting the old session ID a second or two after a request
> determined to regenerate.
>
Session save handlers lock session data to avoid mess, but your approach
works without lock
in many cases. However, it may result in inconsistent session data (i.e.
over written data),
so I would  not recommend it as general usage.

IIRC, the reason why session_regenerate_id(false) by default is
compatibility
for the same minor version release. We should have cleaned up this years
ago.

The main idea of this proposal is "Making PHP secure by default".
It does not worth to keep insecure default forever because of the initial
implementation
had bug. IMHO.

"Making PHP secure by default" also achieves "Easy to learn and use".

BTW, I prefer not to raise errors for "false", since it has valid usage
with save
handlers allow disabling/without lock. e.g. memcached, mm save handlers.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--089e011769159ec4a604e95dfdcf--