Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:93136
Return-Path: <yohgaki@gmail.com>
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Delivered-To: mailing list internals@lists.php.net
Received: (qmail 30397 invoked from network); 10 May 2016 03:25:14 -0000
Received: from unknown (HELO lists.php.net) (127.0.0.1)
  by localhost with SMTP; 10 May 2016 03:25:14 -0000
Authentication-Results: pb1.pair.com smtp.mail=yohgaki@gmail.com; spf=pass; sender-id=pass
Authentication-Results: pb1.pair.com header.from=yohgaki@gmail.com; sender-id=pass
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.182 as permitted sender)
X-PHP-List-Original-Sender: yohgaki@gmail.com
X-Host-Fingerprint: 209.85.220.182 mail-qk0-f182.google.com  
Received: from [209.85.220.182] ([209.85.220.182:33762] helo=mail-qk0-f182.google.com)
	by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP
	id 1F/12-11104-79451375 for <internals@lists.php.net>; Mon, 09 May 2016 23:25:12 -0400
Received: by mail-qk0-f182.google.com with SMTP id n63so203220qkf.0
        for <internals@lists.php.net>; Mon, 09 May 2016 20:25:11 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20120113;
        h=mime-version:sender:from:date:message-id:subject:to;
        bh=UMGX9XTlndON6P1VadOpkWeDXu9kkNZlyUJfGBd8RKw=;
        b=Q9CCOBOzketFKnFvbMQ7zHUT1jXzc60L4P+ixiZD9XxE/OgtQVrvhqrVYihBX72aV1
         IBl+W8c83VJL9xV2Hyl+Vhchjj6rx7t4sIQ7vWkWf6uzUcgtlxGqtbuP5G0BTmIOG+zs
         qqWhYqb/ixGx94LFCZfcXtuierkC9ejIzcnKqXif+WkmATb2ywmLXTcQ38B/wBvDyCpc
         fQluLQHzUFwv1iXdlBs6ziXDL3uz7O18ejssPCQHskZ1l4q6tQclw9lXnTmWCS85KSPt
         D/rIKEwsQU8DtwA+WXstFPoVc4vl99/pR69GjtB5oJEDLe9SXilzztgL/YteY+gyCjIb
         UThA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20130820;
        h=x-gm-message-state:mime-version:sender:from:date:message-id:subject
         :to;
        bh=UMGX9XTlndON6P1VadOpkWeDXu9kkNZlyUJfGBd8RKw=;
        b=gBRxXMWtyly4FYhazexYYZYL/KMep441UsjeyukEgN+jS+ybg8Smep+8n/LSpdrUv/
         dHBWucgwdHaxhjQvVSNTfy6LAO307C4jTgNIskeuOxwttd4ITimmbl3yvLp3nwH4MzA7
         Mv59J2B3s+gb6sqwKYCqRosBRSjM1R9SxzmPQ4w/3WcY33WlS6YWiO5nbmeIW1zaq28J
         hKnrHhu9D38GaZKtHTqljFymXgRMhxQm7Pl/aONSue+nrKZCiKnsZwC285SxNmQ4UeYs
         W1e5Hhaw7CcOxugTIwqj+HHoNu2f5mtvdAFrRejQGLJMp1LaQZghXao2V+WXgpYThwVc
         L5jg==
X-Gm-Message-State: AOPr4FXaUSx+InLWlCcGE7jzlNo2cpT7xMnfcI35oZntwloDzwJt3WmK+y9UNb1FRLZ8j13xuLgEKmfLKp1vwA==
X-Received: by 10.55.165.142 with SMTP id o136mr39059187qke.193.1462850709320;
 Mon, 09 May 2016 20:25:09 -0700 (PDT)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
Received: by 10.140.27.133 with HTTP; Mon, 9 May 2016 20:24:29 -0700 (PDT)
Date: Tue, 10 May 2016 12:24:29 +0900
X-Google-Sender-Auth: _64eL--BZp1N9lfeikfB0BqgWE8
Message-ID: <CAGa2bXZytbD1H-Rg5eWfiPwEM0p47JSQH-GC-ZayDSLbmbsGVA@mail.gmail.com>
To: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: [RFC DRAFT] Automatic CSRF Protection
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi all,

It's not nice to work on the same code (i.e. session module) for
multiple RFCs, but time is limited.

I would like to hear from ideas/comments before I write patch for this.
https://wiki.php.net/rfc/automatic_csrf_protection

Thank you for your comments.

Regards,

P.S. Precise session ID management is important, but this one is also
important. I'll finish and start voting 2 active session RFCs soon. I
may finish all of them hopefully.

--
Yasuo Ohgaki
yohgaki@ohgaki.net