Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:71542
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain devilix.net designates 209.85.216.195 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAH-PCH71z58Ghhg9koPRM8RXYk1bXWSW_ogJqY1TpUAQK8pu6A@mail.gmail.com>
References: <CAPhkiZyMULFgCoTaaqtwx_34ovTX-36dTdVUgMXE_aWPd5O+WQ@mail.gmail.com>
	<CAH-PCH71z58Ghhg9koPRM8RXYk1bXWSW_ogJqY1TpUAQK8pu6A@mail.gmail.com>
Date: Sat, 25 Jan 2014 03:50:32 +0200
Message-ID: <CAPhkiZwsS6wEijXJGHx03f7zf9OFDg9G_2NwMqNDZSmmPsBBZA@mail.gmail.com>
To: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a113a9cd030b61804f0c1b3f6
Subject: Re: [PHP-DEV] Session IP address matching
From: narf@devilix.net (Andrey Andreev)

--001a113a9cd030b61804f0c1b3f6
Content-Type: text/plain; charset=UTF-8

On Sat, Jan 25, 2014 at 3:20 AM, Stas Malyshev <smalyshev@sugarcrm.com>wrote:

> Hi!
>
> > Yes, one can write a custom session handler, but there's a number of
> > problems with that:
>
> Wouldn't using SessionHandler and overriding just, say, read() and
> adding the IP check there solve this issue? You don't have to bother
> with implementing the whole handler, it stays the same but you can check
> the IP after the session is loaded (or before if you wish, depending on
> what you check does).
>

I'm not aware of a way to override just read().
But even even if I could, how would I avoid breaking the rest of the
SessionHandler? The manual implies that read() is where (in userland PHP
terms) fopen() + assign file handle + flock() would happen.

Doesn't make much sense for that to be possible.

On Sat, Jan 25, 2014 at 3:40 AM, Ferenc Kovacs <tyra3l@gmail.com> wrote:

>
> For the record suhosin supports this(
> http://www.hardened-php.net/suhosin/configuration.html#suhosin.session.cryptraddr)
> but to quote from the docs:
> "Keep in mind that this should not be used on sites that have visitors
> from big ISPs, because their IP address often changes during a session. But
> this feature might be interesting for admin interfaces or intranets."
> I agree with that statement, and this is why this can't be a default
> behavior, and given how easy is to extend the default SessionHandler, I'm
> not even sure about providing an optional implementation for this.
>

I'm not suggesting that it should be On by default.
Otherwise, playing with custom session handlers if fun for me, personally.
But trust me when I say this: it is not easy for the majority of people out
there.

--001a113a9cd030b61804f0c1b3f6--