Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:90938
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.160.170 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAGa2bXYj6iCvKqcpf_p6Dm_TNOxtVozry=AONKWu9-VKzb_FHw@mail.gmail.com>
References: <CAGa2bXbg_kebBVg3tSh4uFHZ6nQXRbjUXNQa0JZx9sezQqb5kg@mail.gmail.com>
 <CAGa2bXYZXkCJwFKVwaNfV+OEw0FzeFFbtxLm0zRmFVE_b4xsMw@mail.gmail.com>
 <CAGa2bXbRJMZFcXfZc9o7YnAhkDRfYKPjO+10k-eKXdoGNTREbg@mail.gmail.com>
 <CAGa2bXYGpV=P-680ig1LOkYWsSRS-Ya2rYVa3wo3vrxdT=zwiw@mail.gmail.com>
 <56A727C3.9070505@gmail.com> <CAGa2bXYj6iCvKqcpf_p6Dm_TNOxtVozry=AONKWu9-VKzb_FHw@mail.gmail.com>
Date: Tue, 26 Jan 2016 21:17:27 +0900
Message-ID: <CAGa2bXZ3gFegniSBCtfnnrrotbdCh+MjGufC11nYhd7kH31tuQ@mail.gmail.com>
To: Stanislav Malyshev <smalyshev@gmail.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Re: [RFC Discussion] Precise Session Management
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi Stas,

On Tue, Jan 26, 2016 at 7:28 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> I've already have/will have 3 RFC for session.
> This one, session_id() and user space serialize handler.
> https://github.com/php/php-src/pull/1732
> I would like not to have too many RFCs for session.

I would like to make PHP more secure. Session is only a part of it.

I have
https://wiki.php.net/rfc/dbc2
https://wiki.php.net/rfc/secure_serialization
https://wiki.php.net/rfc/introduce-type-affinity
https://wiki.php.net/rfc/script_only_include
and so on. Even there will new RFCs such as
automatic CSRF protection when this RFC is finished
and URL rewriter bug is fixed.

I also have
https://bugs.php.net/bug.php?id=68599
https://bugs.php.net/bug.php?id=55391
https://bugs.php.net/bug.php?id=68728
https://bugs.php.net/bug.php?id=69791
and so on

Three RFCs for session is just too much for me already...

Anyway, we may be better to talk about how it should be.
For this thread, how session management should be.
It's just not good enough currently. Besides exploiting
PHP session is too easy, random lost sessions is not
acceptable. Weak defaults are not acceptable also. Let's
talk about what's missing still even with this RFC to make
session secure/stable if any.

Better ideas are welcomed. If there is, I'll implement it.
Let's finish mandatory work and move on.

Thanks,

--
Yasuo Ohgaki
yohgaki@ohgaki.net