Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:90933
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.160.169 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <56A72B36.5060307@gmail.com>
References: <CAGa2bXbg_kebBVg3tSh4uFHZ6nQXRbjUXNQa0JZx9sezQqb5kg@mail.gmail.com>
 <CAGa2bXYZXkCJwFKVwaNfV+OEw0FzeFFbtxLm0zRmFVE_b4xsMw@mail.gmail.com>
 <CAGa2bXbRJMZFcXfZc9o7YnAhkDRfYKPjO+10k-eKXdoGNTREbg@mail.gmail.com>
 <CAGa2bXYGpV=P-680ig1LOkYWsSRS-Ya2rYVa3wo3vrxdT=zwiw@mail.gmail.com>
 <CAGa2bXbAH7iDFQ8HbvLKSbq9_ZUJLM1fn6aOWdz4+gYdtXVKjw@mail.gmail.com> <56A72B36.5060307@gmail.com>
Date: Tue, 26 Jan 2016 18:29:02 +0900
Message-ID: <CAGa2bXYPdiO8ZPRwRVJpWbKj6ctjNotGsaOtu=KZUZuV3iY_xQ@mail.gmail.com>
To: Stanislav Malyshev <smalyshev@gmail.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Re: [RFC Discussion] Precise Session Management
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi Stas,

On Tue, Jan 26, 2016 at 5:15 PM, Stanislav Malyshev <smalyshev@gmail.com> wrote:
>> Since this RFC is about preciseness of session management, I would like to
>> change session_id() validates against default allowed chars as follows.
>> (As well as enabling already written session_create_id() function)
>> This patch is against the PR.
>
> I would strongly advise not to add more things into this RFC (see my
> other email). If you want to change which chars are allowed in session
> ID, fine, but let's discuss it in separate topic.

Fine with me.

> However, I would proceed *very* carefully here, as there are apps that
> produce their own session IDs, and breaking them does not help anybody.

Sounds good. As I wrote in previous mail this is going to be largest
BC impact of changes I proposed.

> About, since session_id() is a user function, what do we gain by
> limiting what it does?

Prefix is a part of session ID and it should have the same requirement
as session ID for security reasons.

> For session_create_id(), don't we already have
> SessionHandler::create_sid()?

There is SessionHandler::create_sid(), but there isn't a function that
creates secure session ID. We may do sha1(random_bytes(32)), but
it's better to have function that uses specified hash/data by
session.hash_function/hash_bits_per_characters.

So "sha1(random_bytes(32))" and "session_create_id()" is not equal,
for example.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net