Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:91878
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.213.54 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAPhkiZyn1hh_kdR5sMCxHSw+=kabiPerNT8Y3o8-h6u9d45wNA@mail.gmail.com>
References: <CAGa2bXZqCd4g5BwzRxWsVw351G_o1+AkhGq3cdyKhUW39rm4Tg@mail.gmail.com>
 <56F1A28F.90000@pascal-martin.fr> <CAPhkiZyn1hh_kdR5sMCxHSw+=kabiPerNT8Y3o8-h6u9d45wNA@mail.gmail.com>
Date: Wed, 23 Mar 2016 15:32:03 +0900
Message-ID: <CAGa2bXaWFqM3n4swF8bpVNXo6vzCipSpJXgjBq2_xd1ou6TgMw@mail.gmail.com>
To: Andrey Andreev <narf@devilix.net>
Cc: "Pascal MARTIN, AFUP" <mailing@pascal-martin.fr>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] [RFC][VOTE] Precise session management
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi Andrey,

On Wed, Mar 23, 2016 at 5:03 AM, Andrey Andreev <narf@devilix.net> wrote:
>
> On Tue, Mar 22, 2016 at 9:52 PM, Pascal MARTIN, AFUP <
> mailing@pascal-martin.fr> wrote:
>
>> Le 09/03/2016 10:14, Yasuo Ohgaki a =C3=A9crit :
>>
>>> Vote starts 2016-03-09-09:00(UTC) and ends 2016-03-23-09:00(UTC)
>>> https://wiki.php.net/rfc/precise_session_management#vote
>>>
>>
>> Hi,
>>
>> At AFUP, we would be +1 on this RFC.
>>
>> Basically: better security and pretty-much no bc-break, is a good thing.
>>
>> Thanks for your work on this!
>>
>
> I respect your opinion in wanting to support the proposal, but "pretty mu=
ch
> no BC break"?

Offending features may be disabled/changed by INI settings. I think it ok
to say pretty much no BC issue.

>
> The RFC itself lists 7 points under "Backwards Incompatible Changes" and
> there's at least one more in session_destroy() not deleting data
> immediately.
> It's also not hard to imagine a lot of BC breaks and other unadressed
> problems in custom handlers passed to session_set_save_handler().

The difference that user/3rd party save handlers will see is an additional
array in session data. The additional array should not cause any problems
with session save handlers.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net