Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:91986
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.213.50 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CABHuAWwGe=n6yGYgWNSKvhGvKYYs8=8qpX5tXrv2_g94QZmxLQ@mail.gmail.com>
References: <CAGa2bXauwspEZ4HYSHgVOyd+VEvKxoymWYFPG6NaOdCa+APfKQ@mail.gmail.com>
 <CABHuAWzwxRQxohRca8MvChs4ZdHNk-xc9P5HW93dzkq1TRztoQ@mail.gmail.com>
 <CAKws9z1ihtDyyDQORzs_gJVcOA7Z=A5QzgBf6w1UoP3pd2Ab6A@mail.gmail.com>
 <CABHuAWzaDhP2YN+Gik0vwWmaa9b7m9xjUrNejhLSvosBiv_0CA@mail.gmail.com>
 <56F87611.6040602@gmail.com> <CABHuAWwGe=n6yGYgWNSKvhGvKYYs8=8qpX5tXrv2_g94QZmxLQ@mail.gmail.com>
Date: Tue, 29 Mar 2016 20:41:41 +0900
Message-ID: <CAGa2bXYUN3ZyXy87BjUqYTobUbm8yOS8rojJV_WxT0CvZsmHjQ@mail.gmail.com>
To: Chris Riley <t.carnage@gmail.com>
Cc: Stanislav Malyshev <smalyshev@gmail.com>, Scott Arciszewski <scott@paragonie.com>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] [RFC][Discussion] Precise session data management
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi all,

On Mon, Mar 28, 2016 at 9:23 PM, Chris Riley <t.carnage@gmail.com> wrote:
> You are right, perhaps this should be controlled simply by an ini flag:
> session https only.
>
>
> On Mon, 28 Mar 2016, 01:09 Stanislav Malyshev, <smalyshev@gmail.com> wrote:
>>
>> Hi!
>>
>> >> Could we also add HTTPS detection and enable the secure flag by default
>> >> when a session is established on an HTTPS endpoint?
>>
>> You can not see if your connection would be HTTPS or not - connection
>> can be terminated on frontend services (like nginx or varnish) that
>> handle https and the pass the actual work to backend like fpm or apache
>> or whatever it is. In this situation, you may have no information about
>> if the connection to the client is HTTPS or not.
>>
>> And in general, AFAIK there is no standard protocol to establishing this
>> kind of info. There are all kinds of ways people do it, but each of them
>> is peculiar for specific setup.
>>
>> I also think it is a mistake to have default behavior controlled by
>> external factors beyond server admin's control. Server behavior should
>> be predictable. The admin should set it up properly, if the admin is not
>> knowledgeable enough to set it up, I don't think we can improve it by
>> introducing variable defaults into the mix.

It can be made half-automatic by specifying and detecting HTTPS
connection flag. I think half-automatic will be mostly the same as
current httponly INI setting. It could be confusing for sites that
support both HTTP and HTTPS, too.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net