Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:81104
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain devilix.net designates 209.85.214.169 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXZtNr0ybp_BTU5+L2+O8P8m6dV9AkD+49=ZZ3X-2tYNhA@mail.gmail.com>
References: <CAGa2bXZHP3-uHaXJW_QkEva8wECXwu9C3f=v+xGTVodtyCvQKw@mail.gmail.com>
	<54C1D562.1080402@gmail.com>
	<CAGa2bXZwdQeZHTE4G-6YmNPwT4xmjY9nmGTi_yDPse9vVAKm_w@mail.gmail.com>
	<54C1EE77.7040000@gmail.com>
	<CAGa2bXab+YhAw5P8u2YaHAm2+WbSmn5qs1dsMFNsVEwtns2qpg@mail.gmail.com>
	<54C2DE03.6090708@gmail.com>
	<CAGa2bXYOhmZtYqf6dujMq3oyE3Uk3crd9dBj-Qtj2BMrMBRgug@mail.gmail.com>
	<CAPhkiZzGu7bY0TBzGqNeEHsGN0FYWgw_rWtnmFEkkbg2GCLuQQ@mail.gmail.com>
	<CAGa2bXZtNr0ybp_BTU5+L2+O8P8m6dV9AkD+49=ZZ3X-2tYNhA@mail.gmail.com>
Date: Sun, 25 Jan 2015 04:54:59 +0200
Message-ID: <CAPhkiZxWr95ZMNn3Pq+zkSfQs+kWd7CJVnn-VDVG5BYRqaf7Lw@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: Stanislav Malyshev <smalyshev@gmail.com>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Removing base class from session handler
From: narf@devilix.net (Andrey Andreev)

Hi again,

On Sat, Jan 24, 2015 at 7:48 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> Hi Andrey,
>
> On Sat, Jan 24, 2015 at 6:34 PM, Andrey Andreev <narf@devilix.net> wrote:
>>
>> > This is because session module lacks user defined serializer. Save
>> > handler
>> > handles session data storage. Serialize handler handles how data is
>> > converted/represented. IMHO.
>> >
>>
>> That's not the only use case.
>>
>> Some time ago I proposed a session.match_ip feature and argued that if
>> I wanted to implement it in userland code, I'd have to implement the
>> *whole* session handler from scratch. An example using the
>> SessionHandler class proved me wrong in that regard.
>
>
> For me, IP address matching check does not belong to save handler.
> I would implement it in other place.
>
> What's the reason why you need to implement IP address matching in
> save handler?

To prevent session fixation?

Doesn't matter, I was just giving you an example.

Cheers,
Andrey.