Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:73332
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain devilix.net designates 209.85.213.46 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <20140320094913.GB65574@mail>
References: <CAGa2bXYJqGqegGy=rYcDBXd8RmFFR9j=p2m63ZVSADoga+vwhg@mail.gmail.com>
	<20140319080229.GA83863@mail>
	<CAGa2bXZiGJO+ioJ1qV3YUQVpU9-5TbmdH0WaXmWHxZ_6umYoOQ@mail.gmail.com>
	<20140319111131.GB83863@mail>
	<CAGa2bXa=ib0nrTRzXYtvXos=_mn9jBH4Q+UqipK5P4bLYzXuVA@mail.gmail.com>
	<20140320082346.GA61204@mail>
	<CAGa2bXaf+5_Zo+JGz9GnunJC0qoLESaHowr2VSKxJxbKhHPM+A@mail.gmail.com>
	<20140320091326.GA65574@mail>
	<CAGa2bXavdsU8LMoA9f2CDgTGzKsMhFdB6aVU2pO5WAXqjtBJKg@mail.gmail.com>
	<CAPhkiZy78FanffvfXXHiZ_jffaRAdJfJk-5eH17XgozBXqgvCg@mail.gmail.com>
	<20140320094913.GB65574@mail>
Date: Thu, 20 Mar 2014 12:04:23 +0200
Message-ID: <CAPhkiZz6RD1x=Wv3P2aM_V8RU20A3tXqiA3036rNmp+CdJDgcg@mail.gmail.com>
To: Mateusz Kocielski <shm@digitalsun.pl>
Cc: Yasuo Ohgaki <yohgaki@ohgaki.net>, "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] [RFC] [Discussion] Secure session_regenerate_id()
From: narf@devilix.net (Andrey Andreev)

Hi,

On Thu, Mar 20, 2014 at 11:49 AM, Mateusz Kocielski <shm@digitalsun.pl> wrote:
> On Thu, Mar 20, 2014 at 11:26:13AM +0200, Andrey Andreev wrote:
>
>> > This race condition will not change with or without my proposal.
>>
>> Which is another reason to leave this to user code:
>>
>> ajax_safe_regenerate_id($delete = TRUE)
>> {
>>     if ( ! empty($_SERVER['HTTP_X_REQUESTED_WITH']) &&
>> strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) === 'xmlhttprequest')
>>     {
>>         return FALSE;
>>     }
>>
>>     return session_regenerate_id($delete);
>> }
>
> This is not going to work properly, there's still race. I think that the best
> solution is to handle race on client side (send request once more on session
> error).

There's no race condition, because there's no regeneration if the
request is done through Ajax (provided that the X-Requested-With
header is sent to tell us about that, which popular JS frameworks do),
that is the root cause of the problem.
But the bottom line is - it depends on client side implementation, and
this is an application design detail. It can't be solved by PHP.

Cheers,
Andrey.