Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:69932
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.215.42 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAGa2bXbNFb0tV+Xqavz9m62RDxobey3BmyN0L7g9ATFxMS_KBA@mail.gmail.com>
References: <CAGa2bXbNFb0tV+Xqavz9m62RDxobey3BmyN0L7g9ATFxMS_KBA@mail.gmail.com>
Date: Tue, 29 Oct 2013 19:44:08 +0900
Message-ID: <CAGa2bXZkg6WTFHbgvC3J8M8R7qjZ3V5+pqG0Qe6tVVJ5i8iA1Q@mail.gmail.com>
To: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=089e0158ace0d8f9e004e9dee7d5
Subject: Re: session_regenerate_id(true) by default
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--089e0158ace0d8f9e004e9dee7d5
Content-Type: text/plain; charset=UTF-8

Hi all,

On Tue, Oct 22, 2013 at 3:53 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> Hi all,
>
> Without 'true', session_regenerate_id() will not delete old session data
> which may contain sensitive data. It was made to 'false' by default for
> users relying on the bug. (PHP 4.x, IIRC)
>
> Almost all users should call session_regenerate_id() with 'true'
> parameter. Therefore, I would like to suggest make it 'true' by default
> from next PHP.
>
> Any comments?
>

I've created RFC for this.

https://wiki.php.net/rfc/session_regenerate_id

I think Rowan's proposal is the best, so this RFC proposes to raise
E_DEPRECATED error.

On Wed, Oct 23, 2013 at 8:55 PM, Rowan Collins <rowan.collins@gmail.com>
 wrote:

> So raise an E_DEPRECATED if you don't pass the parameter, and document
> that passing true will normally be the desired behavior. Then in some
> future major version, remove the default value, making it an E_ERROR or
> whatever to omit it.


If there are any more comment, I'll appreciate it.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--089e0158ace0d8f9e004e9dee7d5--