Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:71294
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.178 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAGa2bXbrr3CreZoaasDFWebSG-f4ai-AcTEiX9BGXZLTvjjb+Q@mail.gmail.com>
References: <CAGa2bXZEXx7H+atr3LK8OLLQGSd9a-6+Gey+RhPwP0d7EvTBmw@mail.gmail.com>
 <52DC905F.2080705@sugarcrm.com> <CAGa2bXbrr3CreZoaasDFWebSG-f4ai-AcTEiX9BGXZLTvjjb+Q@mail.gmail.com>
Date: Mon, 20 Jan 2014 13:45:54 +0900
Message-ID: <CAGa2bXZMr2f3r1SAMGAM5fUT-_ZY031VUsQ1irSQAvcwxOP84A@mail.gmail.com>
To: Stas Malyshev <smalyshev@sugarcrm.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=047d7b33da5c8cb3eb04f05f930c
Subject: Re: [PHP-DEV] [VOTE] Introduce session.lock, session.lazy_write and session.lazy_destory
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--047d7b33da5c8cb3eb04f05f930c
Content-Type: text/plain; charset=UTF-8

Hi all,

On Mon, Jan 20, 2014 at 1:27 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> With AJAX or browser supports concurrent access to server,
> concurrent access to server is possible.
>
> When session ID is regenerated, it is possible that some connections
> access to
> server with old session ID. i.e. Race condition.
>
> When this happened, old session that may be known to attacker may be
> reinitialized or new unneeded session ID is created when
> use_strict_mode=On.
>
> Allowing access to old session data for a while prevents these cases that
> initialize
> unneeded session.
>
> RFC proposes deletion flag in $_SESSION. It's a little dirty,
> but it's faster and simpler. It would be acceptable because the session is
> deleted one.
>

Additional comment for this.
session_destroy()/session_gc() deletes session data immediately.
session.lazy_destroy is applicable only when session_regenerate_id() is
called.

The name (session.lazy_destroy) might be better to be changed or
it might be better apply for session_destroy() since there would be
similar race condition like session_regenerate_id().

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--047d7b33da5c8cb3eb04f05f930c--