Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:90950
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.192.181 as permitted sender)
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
References: <CAGa2bXbg_kebBVg3tSh4uFHZ6nQXRbjUXNQa0JZx9sezQqb5kg@mail.gmail.com>
 <CAGa2bXYZXkCJwFKVwaNfV+OEw0FzeFFbtxLm0zRmFVE_b4xsMw@mail.gmail.com>
 <CAGa2bXbRJMZFcXfZc9o7YnAhkDRfYKPjO+10k-eKXdoGNTREbg@mail.gmail.com>
 <CAGa2bXYGpV=P-680ig1LOkYWsSRS-Ya2rYVa3wo3vrxdT=zwiw@mail.gmail.com>
 <CAGa2bXbAH7iDFQ8HbvLKSbq9_ZUJLM1fn6aOWdz4+gYdtXVKjw@mail.gmail.com>
 <56A72B36.5060307@gmail.com>
 <CAGa2bXYPdiO8ZPRwRVJpWbKj6ctjNotGsaOtu=KZUZuV3iY_xQ@mail.gmail.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Message-ID: <56A80C47.1020001@gmail.com>
Date: Tue, 26 Jan 2016 16:16:07 -0800
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:38.0)
 Gecko/20100101 Thunderbird/38.4.0
MIME-Version: 1.0
In-Reply-To: <CAGa2bXYPdiO8ZPRwRVJpWbKj6ctjNotGsaOtu=KZUZuV3iY_xQ@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Re: [RFC Discussion] Precise Session Management
From: smalyshev@gmail.com (Stanislav Malyshev)

Hi!

>> About, since session_id() is a user function, what do we gain by
>> limiting what it does?
> 
> Prefix is a part of session ID and it should have the same requirement
> as session ID for security reasons.

I'm not sure why you're talking about prefix. I thought that the issue
was that user can supply session_id() with the ID that is not good for
some reason and you want to filter it on session_id level. Am I wrong?

> There is SessionHandler::create_sid(), but there isn't a function that
> creates secure session ID.

Why not? The ID created now is not secure? Why? I see it uses
php_session_create_id(), do you mean this function is insecure too? Why?
In any case, if you think it is insecure, why not fix it?
-- 
Stas Malyshev
smalyshev@gmail.com