Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72034
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.215.48 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <52EE1D2E.8060309@sugarcrm.com>
References: <CAGa2bXatpirSgsFhs1bdE72YCk3waPVsgr=M0NsRrwUZ3-5Uzg@mail.gmail.com>
 <52ED7AC8.6080703@sugarcrm.com> <CAGa2bXadBuhW73HP8y3ZDriStKQwOj8Ao+qe7BFFYOgY2C40_w@mail.gmail.com>
 <52EDF03C.5080201@sugarcrm.com> <CAGa2bXaviYguq9bAhHwAti0eOzdrUua9p_jVxZLZcLJ19CV1jQ@mail.gmail.com>
 <52EE1D2E.8060309@sugarcrm.com>
Date: Mon, 3 Feb 2014 11:08:28 +0900
Message-ID: <CAGa2bXaaGW5eQd_RgSQ4KQGUrkJmHHOgtwjxEYGVvps-wCYndw@mail.gmail.com>
To: Stas Malyshev <smalyshev@sugarcrm.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=089e01493d46440cc904f1770240
Subject: Re: [PHP-DEV] [RFC] Secure Session Module Options by Default
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--089e01493d46440cc904f1770240
Content-Type: text/plain; charset=UTF-8

Hi Stas,

On Sun, Feb 2, 2014 at 7:25 PM, Stas Malyshev <smalyshev@sugarcrm.com>wrote:

> > It could have signature like
> >
> > string session_id(string $prefix_or_id [, bool $use_prefix]);
>
> I'm not sure what prefix has to do with this RFC. Didn't we talk about
> secure setting? Where the prefix came from and why we need the prefix at
> all?
>

I see some users are generating unsafe session ID. Purpose of change is
not to generate insecure ID when user want some prefix in session ID.


>
> > We have to decide what we will do about use_strict_mode behavior.
> > It may be easier automatically set use_strict_mode=FALSE.
>
> I'm not sure I understand. So if strict mode is on, when I do
> session_id('foo') and session with ID foo does not exist, what would
> happen? Would session_start() create it or would it generate new ID,
> effectively ignoring my session_id command silently?
>

Yes.
Currently, if 'foo' is not there already, session_id('foo') does not set
session ID, but creates new random session ID when use_strice_mode=on.

string session_id(string $prefix_or_id [, bool $use_prefix=FALSE]);

$use_prefix=TRUE will bypass use_strict_mode=on.



>
> > I would like to expand uniqid() or create new function that returns
> > secure random string, so session_create_id() is not mandatory.
>
> Don't we have such function already?
> http://us1.php.net/manual/en/function.mcrypt-create-iv.php


As discussed in other thread, mcrypt_create_iv() is good one, but
it has some limitations. That's the reason why I think it would be
better to have function that generates secure random ID some how.

Anyway, it is time to compile openssl module by default. IMHO.
It makes security a lot simpler/easier for both users and internal
developers.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--089e01493d46440cc904f1770240--