Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:92168
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.213.66 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAPhkiZxwpy68VARJ7FeMtviC8ZDreFWJH1veP0U=aHX1j1jr7w@mail.gmail.com>
References: <CAGa2bXb-jON8qZyje_ETckyO-KCmcbhTjcJt=NJZ1agAgzqMoQ@mail.gmail.com>
 <CAPhkiZx7zc1=1zyx=vJvZtr7x7OhktDFCHMK4GdOCD_DSqbKCg@mail.gmail.com>
 <CAGa2bXaZnsGnrKAAPmxHG+hut3+1=8bdOER--WrsXXowoiXu=A@mail.gmail.com>
 <CAPhkiZyHruaK9NM4C-4PcQ-2x4QK52Lv+JAyhLHoP=ufcufjWw@mail.gmail.com>
 <CAGa2bXb14ucv2PyHeVHMTcvUrqXD+QehqYHiBZtsqcXW1tgjXA@mail.gmail.com> <CAPhkiZxwpy68VARJ7FeMtviC8ZDreFWJH1veP0U=aHX1j1jr7w@mail.gmail.com>
Date: Fri, 8 Apr 2016 18:39:09 +0900
Message-ID: <CAGa2bXa-cREBoGFjd4gQTu3LFxRdKXrH0xLVFf_3GX4TwjGiWA@mail.gmail.com>
To: Andrey Andreev <narf@devilix.net>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] [RFC][Discussion] Add session_gc()
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi Andrey,

On Fri, Apr 8, 2016 at 6:24 PM, Andrey Andreev <narf@devilix.net> wrote:
> On Fri, Apr 8, 2016 at 11:38 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
>>
>> Hi Andrey,
>>
>> On Fri, Apr 8, 2016 at 5:02 PM, Andrey Andreev <narf@devilix.net> wrote:
>> > On Fri, Apr 8, 2016 at 6:46 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
>> >>
>> >> ,,,
>> >>
>> >> >
>> >> > Speaking of the documentation part - it's not hard to imagine A LOT
>> >> > of
>> >> > people doing this:
>> >> >
>> >> >     session_start();
>> >> >     session_gc();
>> >> >
>> >> > That's not a small problem.
>> >>
>> >> Shooting their own foot is not our problem, but leaving obsolete and
>> >> possibly active session is ours.
>> >>
>> >
>> > If you want to explicitly document something as a best practice, it IS
>> > your
>> > problem when users shoot their feet with it
>>
>> Lack of proper API for required task is our problem. Misuse is not ours.
>> IMHO.
>
>
> I understand your POV, but you can't advertise something as a best practice
> and not warn about mistakes that are easy to make - it would be indecent at
> the very least.

We were getting bug reports like
"Calling save handler function directly crashes PHP".

Many of crash bugs by misuse are fixed, but we have to consider such
misuses also.

We also have to consider service providers. They should be able to use
session_gc() properly and mitigate risk of obsolete session being
active again.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net