Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:81111
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.192.53 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAPhkiZxWr95ZMNn3Pq+zkSfQs+kWd7CJVnn-VDVG5BYRqaf7Lw@mail.gmail.com>
References: <CAGa2bXZHP3-uHaXJW_QkEva8wECXwu9C3f=v+xGTVodtyCvQKw@mail.gmail.com>
 <54C1D562.1080402@gmail.com> <CAGa2bXZwdQeZHTE4G-6YmNPwT4xmjY9nmGTi_yDPse9vVAKm_w@mail.gmail.com>
 <54C1EE77.7040000@gmail.com> <CAGa2bXab+YhAw5P8u2YaHAm2+WbSmn5qs1dsMFNsVEwtns2qpg@mail.gmail.com>
 <54C2DE03.6090708@gmail.com> <CAGa2bXYOhmZtYqf6dujMq3oyE3Uk3crd9dBj-Qtj2BMrMBRgug@mail.gmail.com>
 <CAPhkiZzGu7bY0TBzGqNeEHsGN0FYWgw_rWtnmFEkkbg2GCLuQQ@mail.gmail.com>
 <CAGa2bXZtNr0ybp_BTU5+L2+O8P8m6dV9AkD+49=ZZ3X-2tYNhA@mail.gmail.com> <CAPhkiZxWr95ZMNn3Pq+zkSfQs+kWd7CJVnn-VDVG5BYRqaf7Lw@mail.gmail.com>
Date: Sun, 25 Jan 2015 16:46:54 +0900
Message-ID: <CAGa2bXZ8o3rvo3FtP6q0m3KetrQ3bfSS37_s-iXozrGB9crXYA@mail.gmail.com>
To: Andrey Andreev <narf@devilix.net>
Cc: Stanislav Malyshev <smalyshev@gmail.com>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11c22ccc1febf8050d753c22
Subject: Re: [PHP-DEV] Removing base class from session handler
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a11c22ccc1febf8050d753c22
Content-Type: text/plain; charset=UTF-8

Hi Andrey,

On Sun, Jan 25, 2015 at 11:54 AM, Andrey Andreev <narf@devilix.net> wrote:

> To prevent session fixation?
>
> Doesn't matter, I was just giving you an example.
>

If app may assume that clients have constant IP, then IP may be used to
prevent
stolen sessions. Unfortunately, we live in mobile world, so this solution
may be
used under very limited environments. Using save handler for this purpose
may
trigger error from unknow file/line.

I would advise to write following code somewhere in usual locations.
if ($_SESSION['last_ip'] !== $_SERVER['REMOTE_ADDR']) {
   log_security_breach();
   session_regenerate_id();
   session_unset();
   die_or_trigger_error_if_it_is_needed();
}

Anyway, if anyone would like to implement something fancy in save handlers,
beware that it may result in consequences that you may not be willing to
have.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a11c22ccc1febf8050d753c22--