Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:73331 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 85360 invoked from network); 20 Mar 2014 09:49:17 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 20 Mar 2014 09:49:17 -0000 Authentication-Results: pb1.pair.com smtp.mail=shm@digitalsun.pl; spf=permerror; sender-id=unknown Authentication-Results: pb1.pair.com header.from=shm@digitalsun.pl; sender-id=unknown Received-SPF: error (pb1.pair.com: domain digitalsun.pl from 176.31.254.40 cause and error) X-PHP-List-Original-Sender: shm@digitalsun.pl X-Host-Fingerprint: 176.31.254.40 turing.digitalsun.pl Received: from [176.31.254.40] ([176.31.254.40:56600] helo=mail) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id 0B/19-33112-C99BA235 for ; Thu, 20 Mar 2014 04:49:17 -0500 Received: from localhost (10000@localhost [local]); by mail (OpenSMTPD) with ESMTPA id d7539b7c; Thu, 20 Mar 2014 09:49:13 +0000 (UTC) Date: Thu, 20 Mar 2014 09:49:13 +0000 To: Andrey Andreev Cc: Yasuo Ohgaki , "internals@lists.php.net" Message-ID: <20140320094913.GB65574@mail> References: <20140319080229.GA83863@mail> <20140319111131.GB83863@mail> <20140320082346.GA61204@mail> <20140320091326.GA65574@mail> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Subject: Re: [PHP-DEV] [RFC] [Discussion] Secure session_regenerate_id() From: shm@digitalsun.pl (Mateusz Kocielski) On Thu, Mar 20, 2014 at 11:26:13AM +0200, Andrey Andreev wrote: > > This race condition will not change with or without my proposal. > > Which is another reason to leave this to user code: > > ajax_safe_regenerate_id($delete = TRUE) > { > if ( ! empty($_SERVER['HTTP_X_REQUESTED_WITH']) && > strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) === 'xmlhttprequest') > { > return FALSE; > } > > return session_regenerate_id($delete); > } This is not going to work properly, there's still race. I think that the best solution is to handle race on client side (send request once more on session error). Kind Regrads, Mateusz Kocielski