Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:90586
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.45 as permitted sender)
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
References: <CAGa2bXZzvkBDkqLF2U3yPSprQwqBdHbW9QCZ-nzjA1G4CM8QkQ@mail.gmail.com>
 <56958637.5080807@gmail.com>
 <CAGa2bXaXPdc3rJbcjHz3RC=N6vVOjaorKc9bEOeJR6s-TTs0mg@mail.gmail.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>,
 julien pauli <jpauli@php.net>
Message-ID: <5695A39B.4040701@gmail.com>
Date: Tue, 12 Jan 2016 17:08:43 -0800
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:38.0)
 Gecko/20100101 Thunderbird/38.4.0
MIME-Version: 1.0
In-Reply-To: <CAGa2bXaXPdc3rJbcjHz3RC=N6vVOjaorKc9bEOeJR6s-TTs0mg@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Fixing bug #68063
From: smalyshev@gmail.com (Stanislav Malyshev)

Hi!

> The root cause is browser's cookie handling.
> It appears that browsers do not lock cookie while updating cookies.
> Therefore race condition happens and browsers send empty cookie
> sometimes. I haven't checked the code, but observed it happens.
> 
> I observed handful empty cookies a day with web site has millions
> accesses per day. I circumvented this issue with method described
> in https://wiki.php.net/rfc/precise_session_management
> It worked perfectly.

OK, leaving aside open RFCs, I think we should treat empty ID cookie as
if no cookie were provided at all. Looks like that is what the patch
does? If true, we should merge it. I can do it later tonight.

> Accepting empty cookie is security issue because multiple users
> get the same session ID on occasion. Previous fix that disallows
> empty cookie/raising error works partially, but it was inappropriate
> fix. PHP shouldn't raise error for empty cookie, but should try to
> set new session ID.

Since it is a browser bug and not a PHP bug, I'm not sure whether that
really qualifies... But I guess it woudn't hurt to fix  that.

> I found simple way to observe lost sessions. Please refer to
> https://bugs.php.net/bug.php?id=69127
> It appears that even single threaded CLI server can cause race.

That may be some race condition, but that does not demonstrate empty
session ID as I understand?
-- 
Stas Malyshev
smalyshev@gmail.com