Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:71587
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain devilix.net designates 209.85.216.67 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXbMQzydCTG=bZ3XLzxgLBSzwQ6BUsJGUUtmx2kf=YEXoQ@mail.gmail.com>
References: <CAPhkiZyMULFgCoTaaqtwx_34ovTX-36dTdVUgMXE_aWPd5O+WQ@mail.gmail.com>
	<CAH-PCH71z58Ghhg9koPRM8RXYk1bXWSW_ogJqY1TpUAQK8pu6A@mail.gmail.com>
	<CAPhkiZwsS6wEijXJGHx03f7zf9OFDg9G_2NwMqNDZSmmPsBBZA@mail.gmail.com>
	<52E319F2.8080705@sugarcrm.com>
	<CAPhkiZy7+6hGakv4bXVR2djx18H+s_69OUoyPSjd=JaUVVp61Q@mail.gmail.com>
	<52E3959D.4000103@sugarcrm.com>
	<CAGa2bXZGujJXHpNv3veVg9u8QxRUW=Q__df145x1vJh+KyT3dQ@mail.gmail.com>
	<52E45A5D.7020807@sugarcrm.com>
	<CAGa2bXbDCY3vG-VThsfbRVmZhs7jWzAYu0XDDyq2-WVz_OeAkg@mail.gmail.com>
	<CAGa2bXbMQzydCTG=bZ3XLzxgLBSzwQ6BUsJGUUtmx2kf=YEXoQ@mail.gmail.com>
Date: Sun, 26 Jan 2014 17:46:27 +0200
Message-ID: <CAPhkiZwDgMqHuyTN89_0yJKYnusmELfLR0DV2_i-zoHKg2=GoA@mail.gmail.com>
To: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Session IP address matching
From: narf@devilix.net (Andrey Andreev)

Yes, there are a lot of possible cases where IP addresses could be
changed frequently.
Yes, there are a lot of cases where users would be behind a NAT
gateway or a proxy.
And yes, session.match_ip wouldn't be applicable or as useful under
such conditions.

But consider an intranet environment, the future with IPv6 (even if
not that close as we'd like it to be) or just an otherwise appropriate
user base.
I agree that this feature wouldn't be suitable for your general,
public web application, but I think somebody already pointed out that
this would be useful for admin interfaces. How many applications don't
have that? There certainly are use cases.

On Sun, Jan 26, 2014 at 3:08 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> Hi Stas,
>
> On Sun, Jan 26, 2014 at 10:00 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
>>
>> On Sun, Jan 26, 2014 at 9:44 AM, Stas Malyshev <smalyshev@sugarcrm.com>
>> wrote:
>>>
>>> > which is really bad thing to do. session_create_id() generate ID using
>>> > the same code PHP generates ID which is much secure than above and
>>> > supposed to be faster than user land script.
>>>
>>> I agree that exposing the ID creation function is a good addition
>>> (actually if it was available I'd probably use it in other contexts
>>> where I need a random token, not necessarily a session ID as such).
>>> Maybe we need even more generic function and have session reuse that
>>> code, too.
>>
>>
>> Although I've written it already, I appreciate any comments for
>> improvement. Do you have idea for session_create_id()?
>> Perhaps, more generic function name and/or move to ext/standard?
>
>
> An idea for session_id().
> It would be better to allow session_id() to set SID regardless of
> use_strict_mode. It's programmer's intention.
>
> Should I make this change from 5.5? It's nicer than now.
>
> Regards,
>
> --
> Yasuo Ohgaki
> yohgaki@ohgaki.net
>