Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:93158
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.215.46 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <2e590aa5-9345-02e5-c1a4-7e0470c6c5a3@fleshgrinder.com>
References: <CAGa2bXZytbD1H-Rg5eWfiPwEM0p47JSQH-GC-ZayDSLbmbsGVA@mail.gmail.com>
	<2e590aa5-9345-02e5-c1a4-7e0470c6c5a3@fleshgrinder.com>
Date: Tue, 10 May 2016 18:20:26 +0100
Message-ID: <CABHuAWzpN3MgMuy6-t4ONNj3GRS0SaGgtduxJc1TmLmGxZ7_ag@mail.gmail.com>
To: PHP internals <internals@lists.php.net>
Cc: Yasuo Ohgaki <yohgaki@ohgaki.net>
Content-Type: multipart/alternative; boundary=001a11c3e7fc1775ed0532802406
Subject: Re: [PHP-DEV] [RFC DRAFT] Automatic CSRF Protection
From: t.carnage@gmail.com (Chris Riley)

--001a11c3e7fc1775ed0532802406
Content-Type: text/plain; charset=UTF-8

On 10 May 2016 at 17:48, Fleshgrinder <php@fleshgrinder.com> wrote:

> On 5/10/2016 5:24 AM, Yasuo Ohgaki wrote:
> > Hi all,
> >
> > It's not nice to work on the same code (i.e. session module) for
> > multiple RFCs, but time is limited.
> >
> > I would like to hear from ideas/comments before I write patch for this.
> > https://wiki.php.net/rfc/automatic_csrf_protection
> >
> > Thank you for your comments.
> >
> > Regards,
> >
> > P.S. Precise session ID management is important, but this one is also
> > important. I'll finish and start voting 2 active session RFCs soon. I
> > may finish all of them hopefully.
> >
>
> -1 CSRF protection is a very specific need of some parts of a website
> and not something that is universally required.
>
> --
> Richard "Fleshgrinder" Fussenegger
>
>
Sorry but this isn't something that the language should be concerning
itself with. It will cause more pain than it's worth (think magic quotes).

Also, you suggest that PHP should raise an error on session_start if the
validation fails, most of the time if my app gets a csrf failure an error
would be inappropriate as I'd want to handle it myself and display for
example a form validation error message instead of blowing up the whole
script.

Given that this feature is optional it will do nothing to improve security
whilst adding pain to developers who are producing apps designed to run in
multiple environments eg drupal/wordpress etc so a big -1 from me.

--001a11c3e7fc1775ed0532802406--