Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:73325
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain devilix.net designates 209.85.213.49 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXbJNu0TxAD8FHuVs9nguwj1X=o4khV6FkqebMhU4y=QVg@mail.gmail.com>
References: <CAGa2bXYJqGqegGy=rYcDBXd8RmFFR9j=p2m63ZVSADoga+vwhg@mail.gmail.com>
	<5329E37C.5000106@sugarcrm.com>
	<CAGa2bXaDA=EhqgxZLqkBjTJqPyeogma1oC8L8NiTKx3WKp-rUg@mail.gmail.com>
	<532A43C5.309@sugarcrm.com>
	<CAGa2bXb74KKizUbN_CuEVJwOFDUBUBYe_6deWLk1A9CBhGHZbg@mail.gmail.com>
	<CAEZPtU4TaWSxnYqvceVKPgZJivheRK_M3ynpvasnh+a6+1ps0w@mail.gmail.com>
	<CAGa2bXbJNu0TxAD8FHuVs9nguwj1X=o4khV6FkqebMhU4y=QVg@mail.gmail.com>
Date: Thu, 20 Mar 2014 10:55:13 +0200
Message-ID: <CAPhkiZxB58cb4Gfu34fgiZ1rsi4JaBFFs_q+bEywayq-dr0xRA@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: Pierre Joye <pierre.php@gmail.com>, Stas Malyshev <smalyshev@sugarcrm.com>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] [RFC] [Discussion] Secure session_regenerate_id()
From: narf@devilix.net (Andrey Andreev)

Hi,

> I think most PHP users are using session module as complete tool for their
> web applications.
> They rely on it for proper session management even if the manual explains
> HTTP session
> management cannot be trusted.

You can't fix people's perceptions, and as Mateusz previously noted -
you're trying to fix a problem that appears in an upper layer, that
just isn't possible.

> Since HTTP session management cannot be trusted, ID regeneration is
> required to mitigate
> risks. However, current session_regenerate_id() behavior can be called
> optimum hardly.
> It does not make sure obsolete session is deleted nor does not raise alarm
> for possible
> abuse. When it deletes old session, it is unreliable.
>
> ...
>
> Leaving active session behind is unacceptable risk to me.
> I fail to understand why some of us do not see the risk of current HTTP
> session
> management and/or it should be part of user code.

You keep repeating this argument that deleting the old session is
unreliable, not secure, unacceptable. That is simply not true.
Yes, it's a good practice to try to detect attacks and log them, etc.,
but it's not mandatory, not doing it is not insecure, not a risk, and
it is up to the application developer to decide whether or not to do
it and/or how to do it. There's no silver bullet for this.

> How about serializer wrapper?

It's a different approach, but otherwise the same thing.

Cheers,
Andrey.