Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:71564
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.176 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <52E3959D.4000103@sugarcrm.com>
References: <CAPhkiZyMULFgCoTaaqtwx_34ovTX-36dTdVUgMXE_aWPd5O+WQ@mail.gmail.com>
 <CAH-PCH71z58Ghhg9koPRM8RXYk1bXWSW_ogJqY1TpUAQK8pu6A@mail.gmail.com>
 <CAPhkiZwsS6wEijXJGHx03f7zf9OFDg9G_2NwMqNDZSmmPsBBZA@mail.gmail.com>
 <52E319F2.8080705@sugarcrm.com> <CAPhkiZy7+6hGakv4bXVR2djx18H+s_69OUoyPSjd=JaUVVp61Q@mail.gmail.com>
 <52E3959D.4000103@sugarcrm.com>
Date: Sun, 26 Jan 2014 03:40:07 +0900
Message-ID: <CAGa2bXZGujJXHpNv3veVg9u8QxRUW=Q__df145x1vJh+KyT3dQ@mail.gmail.com>
To: Stas Malyshev <smalyshev@sugarcrm.com>
Cc: Andrey Andreev <narf@devilix.net>, PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11c36c501c209704f0cfd036
Subject: Re: [PHP-DEV] Session IP address matching
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a11c36c501c209704f0cfd036
Content-Type: text/plain; charset=UTF-8

Hi Stas,

On Sat, Jan 25, 2014 at 7:44 PM, Stas Malyshev <smalyshev@sugarcrm.com>wrote:

> > Still, that is not optimal. The desired effect is to call the session
> > file something like:
> >
> >     <session.name>_<REMOTE_ADDR(hash)>_<session_id>
>
> I'm sure there's a reason why you want that, but I'm not sure I'm seeing
> a generic use case for this for core. Why would most of the core users
> care how the session files are named and require them named in a
> specific way?
>

I have client who want to distinguish session by session ID.
They don't want to store IP in session name.

They would like to know creation and modification time w/o
actually reading session data for performance reasons.


> If you want to limit access to sessions to specific IPs only, there
> already is an easy way to do it, by overriding SessionHandler. If you
> want to make sessions stick to IP, there's also pretty easy way to do it
> too. So I wonder - why change the core if it can already easily be done
> with what we have?


The reason why I made session_create_id() is mainly for security
reason. Without it user would something like

$new_session_id = sha1(uniqid());

which is really bad thing to do. session_create_id() generate ID using
the same code PHP generates ID which is much secure than above and
supposed to be faster than user land script.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a11c36c501c209704f0cfd036--