Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:90955
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.50 as permitted sender)
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
References: <CAGa2bXbg_kebBVg3tSh4uFHZ6nQXRbjUXNQa0JZx9sezQqb5kg@mail.gmail.com>
 <CAGa2bXYZXkCJwFKVwaNfV+OEw0FzeFFbtxLm0zRmFVE_b4xsMw@mail.gmail.com>
 <CAGa2bXbRJMZFcXfZc9o7YnAhkDRfYKPjO+10k-eKXdoGNTREbg@mail.gmail.com>
 <CAGa2bXYGpV=P-680ig1LOkYWsSRS-Ya2rYVa3wo3vrxdT=zwiw@mail.gmail.com>
 <CAGa2bXbAH7iDFQ8HbvLKSbq9_ZUJLM1fn6aOWdz4+gYdtXVKjw@mail.gmail.com>
 <56A72B36.5060307@gmail.com>
 <CAGa2bXYPdiO8ZPRwRVJpWbKj6ctjNotGsaOtu=KZUZuV3iY_xQ@mail.gmail.com>
 <56A80C47.1020001@gmail.com>
 <CAGa2bXYdxcW8-wSwwQU6VgaC2b707cUGkxpAOc28YQAMrdQikQ@mail.gmail.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Message-ID: <56A81BE5.6030200@gmail.com>
Date: Tue, 26 Jan 2016 17:22:45 -0800
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:38.0)
 Gecko/20100101 Thunderbird/38.4.0
MIME-Version: 1.0
In-Reply-To: <CAGa2bXYdxcW8-wSwwQU6VgaC2b707cUGkxpAOc28YQAMrdQikQ@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Re: [RFC Discussion] Precise Session Management
From: smalyshev@gmail.com (Stanislav Malyshev)

Hi!

> Oops, sorry. Too many lines to reply, I misread session_id()/session_create_id()
> 
> session_id() sets session ID. Invalid char that cannot be accepted should be
> rejected. Otherwise, user will have lost sessions without errors.

As far as I know, handlers already reject characters that are not OK
with them. So what is missing there?

> SessionHandler::create_sid() is for creating user own ID. Generating ID with
> certain prefix.

Not sure what you mean. The code here:
https://github.com/php/php-src/blob/master/ext/session/mod_user_class.c#L175
is clearly generating an ID. Is this not secure enough?

> Currently, there is no simple way to generate session ID with the form
> of session module generates. i.e. hash_bits_per_characters=5/6. There
> should be an API for it.

Wait, so which ID the  SessionHandler::create_sid() generates? Isn't
that the same function? Which function you plan to use instead?
-- 
Stas Malyshev
smalyshev@gmail.com