Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:73212
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.215.47 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAPhkiZzAxQnQpWOh7xhAM4h3r7xCYjD_P3d9mWmDX4Sr0Qc9Ng@mail.gmail.com>
References: <CAPhkiZzAxQnQpWOh7xhAM4h3r7xCYjD_P3d9mWmDX4Sr0Qc9Ng@mail.gmail.com>
Date: Mon, 17 Mar 2014 19:51:07 +0900
Message-ID: <CAGa2bXZHYJzcV2E-SDN7-u1_SLrW8Tr7hwkQG5JSnD-7oh-Xvg@mail.gmail.com>
To: Andrey Andreev <narf@devilix.net>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11345630c7f16f04f4cb340e
Subject: Re: [PHP-DEV] Session: deprecating create_sid() method and add createSid()?
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a11345630c7f16f04f4cb340e
Content-Type: text/plain; charset=UTF-8

Hi Andrey,

On Mon, Mar 17, 2014 at 7:23 PM, Andrey Andreev <narf@devilix.net> wrote:

> There's no SessionHandler::create_sid() or
> SessionHandlerInterface::create_sid() documented (see your own link to
> the docs) ... since when is this available?
>
> I'm not sure if exposing it is a good idea anyway, why is it necessary?
>

This change is not mine. It was added about 10 years ago, IIRC.

Having createSid() could be useful. For example, user may have certain
prefix for session
IDs. User ID prefix is especially useful to know how many active sessions
are there.
(Note: I advise to use MD5('user_id'.'random_secret') for user ID prefixing
if user_id
 shouldn't be exposed.)

I've added session_create_id(). Therefore, if user start using it, it does
not hart much.
If users do not need modified session ID, they may call session_create_id()
simply.

The reason why this is added is Stefan Esser's strict session patch had
this, I guess.
However, his patch was not fully merged and session remained weak until
'use_strice_mode'
patch.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a11345630c7f16f04f4cb340e--