Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:85345
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.218.52 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAGa2bXZjXGQvb+h+ygB2A-KK1Zg=jvoiu0Oq1C6nOH37=bL+SQ@mail.gmail.com>
References: <CAGa2bXb2qm3Y0S_dVDe+Orh6kbuuQOOgLNc_VwycZCCiSxPZ2w@mail.gmail.com>
 <CAGa2bXauT9Kq74FDqq+0gyGUUa5FRirkryRHtBVei5hLJHbVUw@mail.gmail.com>
 <20150320101241.GA69273@mail.digitalsun.pl> <CAGa2bXZjXGQvb+h+ygB2A-KK1Zg=jvoiu0Oq1C6nOH37=bL+SQ@mail.gmail.com>
Date: Sat, 21 Mar 2015 07:12:32 +0900
Message-ID: <CAGa2bXaiuKEJ66=RVtb+WHDjv5nTB9LaYq4Jt9wve9xeCn0CVA@mail.gmail.com>
To: Mateusz Kocielski <shm@digitalsun.pl>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=089e0118236254f52b0511bf9f24
Subject: Re: [PHP-DEV] Re: Bug #69127 session_regenerate_id(true) randomly
 generates a warning and loses session data
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--089e0118236254f52b0511bf9f24
Content-Type: text/plain; charset=UTF-8

Hi all,

On Sat, Mar 21, 2015 at 6:43 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

>  Please note that if destroy fails, then new session is not generated,
>> possible (but ugly) solution is to call session_regenerate_id again.
>>
>
> It just does not work.
> How do you keep session for lost session?
>
> Lost session occurs like
>
> 1. Server executes session_regenerate_id(true), delete old data and send
>     new session ID with copied data to browser.
> 2. Unstable network lost packet that sets new session ID.
> 3. Browser thinks old session ID is valid, but there is no session data
> for it.
>
> Besides, there is issue that session data must be deleted may keep alive
> forever. Current session management is not predictable and precise at all.
>
> If there is better idea other than the RFC, I appreciate it.
>

One more additional note.

Databases use 2 phase commit to synchronize multiple databases. Similar
method cannot be used because HTTP is stateless. i.e. Connections are
closed. Even with HTTP/2, user may have multiple independent connections,
i.e. multiple tabs, and there is no lock mechanism. It just cannot work.
Therefore, 2 phase commit cannot be used.

I cannot think of perfect locking mechanism that synchronize server and
browser.
i.e. Locking can be done by using additional cookie, but I cannot make sure
browsers has synchronized time.  If there is reliable locking, synchronous
session management can be done. Even if there is, it would cost too much.
e.g. Time consuming and too complex for the purpose.

Ideas are appreciated.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--089e0118236254f52b0511bf9f24--