Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:90957 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 89626 invoked from network); 27 Jan 2016 01:30:57 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 27 Jan 2016 01:30:57 -0000 Authentication-Results: pb1.pair.com header.from=yohgaki@gmail.com; sender-id=pass Authentication-Results: pb1.pair.com smtp.mail=yohgaki@gmail.com; spf=pass; sender-id=pass Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.160.178 as permitted sender) X-PHP-List-Original-Sender: yohgaki@gmail.com X-Host-Fingerprint: 209.85.160.178 mail-yk0-f178.google.com Received: from [209.85.160.178] ([209.85.160.178:32869] helo=mail-yk0-f178.google.com) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id 1F/75-56702-FCD18A65 for ; Tue, 26 Jan 2016 20:30:55 -0500 Received: by mail-yk0-f178.google.com with SMTP id k129so224488282yke.0 for ; Tue, 26 Jan 2016 17:30:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc:content-type; bh=mTG79zQmp4OQGT4fnzogDR+qS81gSvsKE728InKzrn0=; b=SRY2DV06rb9ZlrQAn+1WR0duE57rTM5puuRQTi0tRMgJn8m1nKnrBn8Hi3gpY52yYA EtBqMNzgPpDc9k5tBkLYLPuHEFrun1kdJ7/b561OQGTQz2/XpoWUChQ8n7bEp07INVWV KnS/HVsg+Q/hAOaGbs7kOQci+t6R+oJhTD4qhd2XcARY+hLnQoVKN/82J6r5l6+84uH4 MrFV4LGmxt7nPC5hZ8OJLb5OsWuf/dddD8fty97dZ1/U4H3QrWegbv8zLuPgU8lO5NWU rED/o1+A+5f8F2gBl4RURYjdMhvGYkWuk7D0ZNaATKkXuMxzcZwZnhLZnfYH89bX73Qm hghw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:sender:in-reply-to:references:from :date:message-id:subject:to:cc:content-type; bh=mTG79zQmp4OQGT4fnzogDR+qS81gSvsKE728InKzrn0=; b=XahCKU+dfbYHCNHMAEQFfK2IfaV2vGGyP+9hsHSqd0tuKDmoXXL+HEnakUdiS8G3K4 0RcWsG3QUyxTEOswSLEx/SuDuFZ4ObVyMMaPXwtIU3uyOghWCu8H3Il46mvoCEpXI7NR HJOYnlI53+1PTBoTM1r+AZ0LccSARGEzlXeS6p3EICDwE9emTqaDEPB1fZKqHoqSETYX CIBRc61Qvc0uh2bKifgUZ+fQ57uq3VwNPgbFtZhJLfu77O5Mgisn4MffxxvuktXgVPLh hpZm5a5GlOoKh52qmBnQbDQhLE1DsGFoLKZWAjvO4M5yyzrlHdvKwYOrTywCb1TBvxOk 92Rg== X-Gm-Message-State: AG10YOQeNtzS1OqzzaV5nWj7AphwDBIcUlRZc8Q3KdYhI/ohovDmWg2KokkL1EqcVT1vqwnef4xDOaT8YI+Csw== X-Received: by 10.37.59.20 with SMTP id i20mr13310407yba.27.1453858252801; Tue, 26 Jan 2016 17:30:52 -0800 (PST) MIME-Version: 1.0 Sender: yohgaki@gmail.com Received: by 10.129.88.139 with HTTP; Tue, 26 Jan 2016 17:30:13 -0800 (PST) In-Reply-To: <56A81BE5.6030200@gmail.com> References: <56A72B36.5060307@gmail.com> <56A80C47.1020001@gmail.com> <56A81BE5.6030200@gmail.com> Date: Wed, 27 Jan 2016 10:30:13 +0900 X-Google-Sender-Auth: 7jDidCc25EM885c_PYmQlSASzrM Message-ID: To: Stanislav Malyshev Cc: "internals@lists.php.net" Content-Type: text/plain; charset=UTF-8 Subject: Re: [PHP-DEV] Re: [RFC Discussion] Precise Session Management From: yohgaki@ohgaki.net (Yasuo Ohgaki) Hi Stas, On Wed, Jan 27, 2016 at 10:22 AM, Stanislav Malyshev wrote: > >> Oops, sorry. Too many lines to reply, I misread session_id()/session_create_id() >> >> session_id() sets session ID. Invalid char that cannot be accepted should be >> rejected. Otherwise, user will have lost sessions without errors. > > As far as I know, handlers already reject characters that are not OK > with them. So what is missing there? Session module/save handlers removes invalid chars silently. This changes user defined session ID, thus session is lost without apparent errors. > >> SessionHandler::create_sid() is for creating user own ID. Generating ID with >> certain prefix. > > Not sure what you mean. The code here: > https://github.com/php/php-src/blob/master/ext/session/mod_user_class.c#L175 > is clearly generating an ID. Is this not secure enough? If php_session_create_id() which is session module function, it's secure. Users may create whatever session IDs, though. > >> Currently, there is no simple way to generate session ID with the form >> of session module generates. i.e. hash_bits_per_characters=5/6. There >> should be an API for it. > > Wait, so which ID the SessionHandler::create_sid() generates? Isn't > that the same function? Which function you plan to use instead? I mean there is no way to call php_session_create_id() without user defined save handler. Main use case of session_create_id() and session_id() would be prefixed session like session_id(session_create_id('MY-PREFIX-')); Regards, -- Yasuo Ohgaki yohgaki@ohgaki.net