Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:70001
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.171 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <5749CE46-8438-42F8-95D0-B854E35CC29E@zend.com>
References: <CAGa2bXbNFb0tV+Xqavz9m62RDxobey3BmyN0L7g9ATFxMS_KBA@mail.gmail.com>
 <CAGa2bXZkg6WTFHbgvC3J8M8R7qjZ3V5+pqG0Qe6tVVJ5i8iA1Q@mail.gmail.com>
 <526FED0D.4040709@oracle.com> <5749CE46-8438-42F8-95D0-B854E35CC29E@zend.com>
Date: Mon, 4 Nov 2013 12:32:20 +0900
Message-ID: <CAGa2bXYNAoDZJ0UQxbwr4zgf=Z3xYpnNeZxfsUowHXt=cYQKvQ@mail.gmail.com>
To: Andi Gutmans <andi@zend.com>
Cc: Christopher Jones <christopher.jones@oracle.com>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=089e0117720fab199e04ea51924c
Subject: Re: [PHP-DEV] session_regenerate_id(true) by default
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--089e0117720fab199e04ea51924c
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hi Andi,

On Mon, Nov 4, 2013 at 9:00 AM, Andi Gutmans <andi@zend.com> wrote:

> On Oct 29, 2013, at 10:14 AM, Christopher Jones <
> christopher.jones@oracle.com> wrote:
>
>
> Hi Yasuo,
>
> If parameter omission is an issue, I think you should update the PHP
> function doc ASAP and explain the problem.
>
> Most E_DEPRECATED messages include the word "deprecated".  I think
> your message could be:
>
>  "Calling session_regenerate_id() without a parameter is
>   deprecated. Passing true is encouraged for better security"
>
> Can you review whether "false" should ever be an allowed value?
>
>
> I think we would want to continue to support false (we can check
> code.google.com or something to see how much it=E2=80=99s being used with=
out
> parameters or with false). [I am not online now unfortunately].
>
> Eliminating the default option can absolutely work as it means users need
> to make a conscious decision.
>

I think the option should be kept forever.
I'll add race condition mitigation into session module, but it's a
mitigation, not a solution.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--089e0117720fab199e04ea51924c--