Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:89853
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.213.43 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXaiqHvAxW4OdcAWfGk2KpMW9ZmZsODSK7W2p4j6_FL79w@mail.gmail.com>
References: <CAGa2bXbg_kebBVg3tSh4uFHZ6nQXRbjUXNQa0JZx9sezQqb5kg@mail.gmail.com>
	<CAGa2bXaiqHvAxW4OdcAWfGk2KpMW9ZmZsODSK7W2p4j6_FL79w@mail.gmail.com>
Date: Sun, 20 Dec 2015 22:24:24 -0600
Message-ID: <CALrkBjaWRc-1=HKZOm3gOuRSNyjUuW94PdYDOdOg1sQOOqXXgg@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11431f842ff545052760dd6d
Subject: Re: [PHP-DEV] Re: [RFC Discussion] Precise Session Management
From: pencap@gmail.com (Mike Willbanks)

--001a11431f842ff545052760dd6d
Content-Type: text/plain; charset=UTF-8

Hello Yasuo,

On Sun, Dec 20, 2015 at 7:01 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> Hi all,
>
> On Sat, Dec 19, 2015 at 7:33 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> > I would like to restart better session management for PHP 7.1.
> >
> > https://wiki.php.net/rfc/precise_session_management
> >
> > Although this RFC targets PHP 7.1, new session management
> > could be applied to older releases also if majority of us agree.
> > Please comment.
>
> I would like to write patch for this next week.
> If you have comment, please comment this week.
>

This week is hard due to several holidays, I would recommend postponing
discussion until after.


However, I will comment on a few things that I dislike of the RFC:

Exposing the internal state of the session via a key on the session
__SESSION_INTERNAL__ may be dangerous.  How are you preventing writes to
this area?  Is an exception or error thrown?  I also do not feel that it is
worth encoding this directly into the session value but would be of far
greater benefit to expose through functions and ensure it is not touched
and protected from user land.  Anything that messes with the $_SESSION can
cause major issues (for instance upload progress did this and can cause
session corruption in certain cases as it manipulates the session state).

I fully agree that session_regenerate_id needs some additional work.
Although. I do not think that the implementation here seems like the
correct path as a general comment.




>
> Regards,
>
> --
> Yasuo Ohgaki
> yohgaki@ohgaki.net
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>

--001a11431f842ff545052760dd6d--