Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:90954
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.160.173 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <56A80C47.1020001@gmail.com>
References: <CAGa2bXbg_kebBVg3tSh4uFHZ6nQXRbjUXNQa0JZx9sezQqb5kg@mail.gmail.com>
 <CAGa2bXYZXkCJwFKVwaNfV+OEw0FzeFFbtxLm0zRmFVE_b4xsMw@mail.gmail.com>
 <CAGa2bXbRJMZFcXfZc9o7YnAhkDRfYKPjO+10k-eKXdoGNTREbg@mail.gmail.com>
 <CAGa2bXYGpV=P-680ig1LOkYWsSRS-Ya2rYVa3wo3vrxdT=zwiw@mail.gmail.com>
 <CAGa2bXbAH7iDFQ8HbvLKSbq9_ZUJLM1fn6aOWdz4+gYdtXVKjw@mail.gmail.com>
 <56A72B36.5060307@gmail.com> <CAGa2bXYPdiO8ZPRwRVJpWbKj6ctjNotGsaOtu=KZUZuV3iY_xQ@mail.gmail.com>
 <56A80C47.1020001@gmail.com>
Date: Wed, 27 Jan 2016 10:18:20 +0900
Message-ID: <CAGa2bXYdxcW8-wSwwQU6VgaC2b707cUGkxpAOc28YQAMrdQikQ@mail.gmail.com>
To: Stanislav Malyshev <smalyshev@gmail.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Re: [RFC Discussion] Precise Session Management
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi Stas,

On Wed, Jan 27, 2016 at 9:16 AM, Stanislav Malyshev <smalyshev@gmail.com> wrote:
>>> About, since session_id() is a user function, what do we gain by
>>> limiting what it does?
>>
>> Prefix is a part of session ID and it should have the same requirement
>> as session ID for security reasons.
>
> I'm not sure why you're talking about prefix. I thought that the issue
> was that user can supply session_id() with the ID that is not good for
> some reason and you want to filter it on session_id level. Am I wrong?

Oops, sorry. Too many lines to reply, I misread session_id()/session_create_id()

session_id() sets session ID. Invalid char that cannot be accepted should be
rejected. Otherwise, user will have lost sessions without errors.

>
>> There is SessionHandler::create_sid(), but there isn't a function that
>> creates secure session ID.
>
> Why not? The ID created now is not secure? Why? I see it uses
> php_session_create_id(), do you mean this function is insecure too? Why?
> In any case, if you think it is insecure, why not fix it?

SessionHandler::create_sid() is for creating user own ID. Generating ID with
certain prefix.

SessionHandler::create_sid() may call parent create ID function,
though. If parent is session module's save handler, it will call
php_session_create_id().

Currently, there is no simple way to generate session ID with the form
of session module generates. i.e. hash_bits_per_characters=5/6. There
should be an API for it.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net