Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:91978
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.174 as permitted sender)
MIME-Version: 1.0
References: <CAGa2bXauwspEZ4HYSHgVOyd+VEvKxoymWYFPG6NaOdCa+APfKQ@mail.gmail.com>
 <CABHuAWzwxRQxohRca8MvChs4ZdHNk-xc9P5HW93dzkq1TRztoQ@mail.gmail.com>
 <CAKws9z1ihtDyyDQORzs_gJVcOA7Z=A5QzgBf6w1UoP3pd2Ab6A@mail.gmail.com>
 <CABHuAWzaDhP2YN+Gik0vwWmaa9b7m9xjUrNejhLSvosBiv_0CA@mail.gmail.com> <56F87611.6040602@gmail.com>
In-Reply-To: <56F87611.6040602@gmail.com>
Date: Mon, 28 Mar 2016 12:23:18 +0000
Message-ID: <CABHuAWwGe=n6yGYgWNSKvhGvKYYs8=8qpX5tXrv2_g94QZmxLQ@mail.gmail.com>
To: Stanislav Malyshev <smalyshev@gmail.com>, Scott Arciszewski <scott@paragonie.com>
Cc: Yasuo Ohgaki <yohgaki@ohgaki.net>, "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=089e0117716fe1f69b052f1afad3
Subject: Re: [PHP-DEV] [RFC][Discussion] Precise session data management
From: t.carnage@gmail.com (Chris Riley)

--089e0117716fe1f69b052f1afad3
Content-Type: text/plain; charset=UTF-8

You are right, perhaps this should be controlled simply by an ini flag:
session https only.

On Mon, 28 Mar 2016, 01:09 Stanislav Malyshev, <smalyshev@gmail.com> wrote:

> Hi!
>
> >> Could we also add HTTPS detection and enable the secure flag by default
> >> when a session is established on an HTTPS endpoint?
>
> You can not see if your connection would be HTTPS or not - connection
> can be terminated on frontend services (like nginx or varnish) that
> handle https and the pass the actual work to backend like fpm or apache
> or whatever it is. In this situation, you may have no information about
> if the connection to the client is HTTPS or not.
>
> And in general, AFAIK there is no standard protocol to establishing this
> kind of info. There are all kinds of ways people do it, but each of them
> is peculiar for specific setup.
>
> I also think it is a mistake to have default behavior controlled by
> external factors beyond server admin's control. Server behavior should
> be predictable. The admin should set it up properly, if the admin is not
> knowledgeable enough to set it up, I don't think we can improve it by
> introducing variable defaults into the mix.
> --
> Stas Malyshev
> smalyshev@gmail.com
>

--089e0117716fe1f69b052f1afad3--