Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:73329
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain devilix.net designates 209.85.160.173 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXavdsU8LMoA9f2CDgTGzKsMhFdB6aVU2pO5WAXqjtBJKg@mail.gmail.com>
References: <CAGa2bXYJqGqegGy=rYcDBXd8RmFFR9j=p2m63ZVSADoga+vwhg@mail.gmail.com>
	<20140319080229.GA83863@mail>
	<CAGa2bXZiGJO+ioJ1qV3YUQVpU9-5TbmdH0WaXmWHxZ_6umYoOQ@mail.gmail.com>
	<20140319111131.GB83863@mail>
	<CAGa2bXa=ib0nrTRzXYtvXos=_mn9jBH4Q+UqipK5P4bLYzXuVA@mail.gmail.com>
	<20140320082346.GA61204@mail>
	<CAGa2bXaf+5_Zo+JGz9GnunJC0qoLESaHowr2VSKxJxbKhHPM+A@mail.gmail.com>
	<20140320091326.GA65574@mail>
	<CAGa2bXavdsU8LMoA9f2CDgTGzKsMhFdB6aVU2pO5WAXqjtBJKg@mail.gmail.com>
Date: Thu, 20 Mar 2014 11:26:13 +0200
Message-ID: <CAPhkiZy78FanffvfXXHiZ_jffaRAdJfJk-5eH17XgozBXqgvCg@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: Mateusz Kocielski <shm@digitalsun.pl>, "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] [RFC] [Discussion] Secure session_regenerate_id()
From: narf@devilix.net (Andrey Andreev)

Hi,

>> Consider following scenario:
>>
>> 1. session_regenerate_id(..) is called
>> 2. request to /update_session with old session id is done (some key-value
>> in
>> session is changed) - with your change this request will succeed
>> --- from here user uses only new session -
>> 3. updated key-value is missing in new session
>>
>> (same scenario can be triggered now if old session is not deleted)
>
>
> This race condition will not change with or without my proposal.

Which is another reason to leave this to user code:

ajax_safe_regenerate_id($delete = TRUE)
{
    if ( ! empty($_SERVER['HTTP_X_REQUESTED_WITH']) &&
strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) === 'xmlhttprequest')
    {
        return FALSE;
    }

    return session_regenerate_id($delete);
}

Cheers,
Andrey.