Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:91882
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.213.46 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAGa2bXZLbajogAcL8LamtbvmSSPDmQ2HwRgCfGKoXT9DjVyqKg@mail.gmail.com>
References: <CAGa2bXZLbajogAcL8LamtbvmSSPDmQ2HwRgCfGKoXT9DjVyqKg@mail.gmail.com>
Date: Thu, 24 Mar 2016 11:26:07 +0900
Message-ID: <CAGa2bXbvBifm5e8eJKEE-zt7j4EToHMWFcWKVnEfKTAdxa00ww@mail.gmail.com>
To: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [RFC Discussion] Precise session management
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi all,

On Sun, Feb 14, 2016 at 9:49 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> It's been long time since the first proposal. Since session
> module is important module for Web apps, I would like to
> hear opinions for this RFC once again before vote.
>
> RFC
> https://wiki.php.net/rfc/precise_session_management
>
> PR
> https://github.com/php/php-src/pull/1734
>
> Thank you.

Vote is over and the result is  15 in favor and 11 against.
It's over half of votes, but I set 2/3 to pass, so we have to come up
to other solution for current session management problems.

I'm looking forward to hear alternatives from people vote against this RFC.

Issues are
 - Prevent race conditions.
 - Prevent session data from abuse. (Stolen session including forever)

These are allowed with current session module.

Thank you!

--
Yasuo Ohgaki
yohgaki@ohgaki.net