Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:93266
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.169 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <57344C6C.2060707@lsces.co.uk>
References: <CAGa2bXZytbD1H-Rg5eWfiPwEM0p47JSQH-GC-ZayDSLbmbsGVA@mail.gmail.com>
 <c21d1d4b-a790-e1a9-7c93-2c5af4baf5d1@gmail.com> <CAGa2bXboop3KDFnYtcdO-K+hL0To5te_yeHeFEFO-kCVuzNOJQ@mail.gmail.com>
 <3b115b37-d399-0b69-24b4-de5c95c4a069@gmail.com> <CAGa2bXZwRK0GuXbT53B4w+h5ySiVJnJpo-d87Uiw-reYHi80zQ@mail.gmail.com>
 <CANUQDChxOeydBRLPrvuumf+edqJNKV+TOstGz66X_tg+Y7knPQ@mail.gmail.com>
 <CAGa2bXZC8Qp8-Ggyfj5+0X5aiktSX_AyfRdKAPXFZ=x4+A1XDQ@mail.gmail.com>
 <CANUQDCgi-P4=rWA5H+53_BcWyqeWaC_QOADUNMb_jV70KuhEPw@mail.gmail.com>
 <CAL0xaBFTF28h7ZTCkk=gn2=kepv0xe_Gk0+zjhmZzDmLJYU3-w@mail.gmail.com>
 <CAGa2bXbX_YhpJEr+9XjTb3xxgb2KTw=LEjC97A0vM4_WNiSvnA@mail.gmail.com>
 <CAL0xaBF8e7PhY_hqNYwNvxwRiha1=rUtLBfugUNC2FGf2FndzA@mail.gmail.com>
 <CAGa2bXa8B+4vuOiWNSt79gcSvyr2aAKv_VEbigiKTVsuaZT89g@mail.gmail.com>
 <CAEZPtU7SW+yDmv_uNr_YB3MeVq_saiySaDZpF2jTOQqBzbw9Mg@mail.gmail.com>
 <CAGa2bXbwJHRES6Bf+u07pO2e9WS6C+sTwjoY9p8kWAUntSLbCQ@mail.gmail.com> <57344C6C.2060707@lsces.co.uk>
Date: Thu, 12 May 2016 20:29:33 +0900
Message-ID: <CAGa2bXayMhvYLwrTdnwzs=PJr3WaLLOeTQvKZOu+fdMJ79U=Rw@mail.gmail.com>
To: Lester Caine <lester@lsces.co.uk>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] [RFC DRAFT] Automatic CSRF Protection
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi Lester,

On Thu, May 12, 2016 at 6:27 PM, Lester Caine <lester@lsces.co.uk> wrote:
> On 12/05/16 04:19, Yasuo Ohgaki wrote:
>> It could be an option that abandon session module and let users to
>> implement decent session manager because we are taking too long time
>> even for mandatory things even if there are implementations. It is
>> simply taking too long time to fix them. I'm half joking, but half
>> serious :)
>
> Yasuo ... THIS is the situation with a number of elements of PHP, and I
> DO understand where you are coming from. PHP is nicely modular and so
> creating a complete module ... well documented ... clean API ... makes
> perfect sense. Getting acceptance may be a different matter, such as
> switching from mysql to mysqli, but it does provide a document-able
> upgrade path for the problem in hand.
>
> I'm the first to admit I rely on the simple options so still use
> anonymous session for the majority of users simply because they are
> never going to log in, while I conciser and authenticated user as a
> different animal so needs a different type of security. That is the main
> reason I posted the 'off topic' bits earlier in this thread. It IS a
> matter of what is the ideal set-up for the vast majority of PHP users
> who can justify laying out lots of money for the best chargeable
> security, and there is now at least a path that can be documented to
> help them which includes https, sessions and authentication?

I was half serious and willing to maintain/improve session module,
security related area especially.

Anyway, session module should be like RDBMS, not NoSQL. I don't want
to care about locks, race conditions, synchronization,
vulnerabilities, etc. It should just work out of the box with
reasonable default behavior. IMO.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net