Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94995
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain ohgaki.net designates 180.42.98.130 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CADyq6sKE87hjt63fSUCpucGRNZendwv-WKyhA=75Yo7mbuT7rw@mail.gmail.com>
References: <CAGa2bXaZhfXbU6N0-JGVPzkkxRdkcjEhkHP+YrQNH=XFX714-Q@mail.gmail.com>
 <CADyq6sKE87hjt63fSUCpucGRNZendwv-WKyhA=75Yo7mbuT7rw@mail.gmail.com>
Date: Wed, 10 Aug 2016 19:03:59 +0900
Message-ID: <CAGa2bXZ9YeogdMMFKHa5iWQKcbe_0FrUAbE-pkanf5qKNx06bA@mail.gmail.com>
To: Marco Pivetta <ocramius@gmail.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] [RFC][VOTE] Add session_create_id() function
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi Marco,

On Wed, Aug 10, 2016 at 6:31 PM, Marco Pivetta <ocramius@gmail.com> wrote:
> The RFC mentions "Without session_create_id(), user has to implement their
> own bin_to_readable() in user land.".
> This pretty much makes it clear that a userland implementation is feasible,
> and thus it should indeed be implemented in userland when possible.
>
> That's my reasoning for voting "no".

Thank you for sharing your idea!

> This pretty much makes it clear that a userland implementation is feasible,
> and thus it should indeed be implemented in userland when possible.

Actually, it's not with C written 3rd party session save handlers.
Properly written save handlers should have internal s_validate_sid()
function to check session ID collisions. User script cannot access to
save handler internals. Therefore, it requires a lot of work if user
try to create session ID properly. i.e. Validate generated session ID
string does not collide.

There is API design issue also.
Let's say we add

string str_bin2readble(string $binary, int $bis_per_char);

then we need

string str_reable2bin(string $readble_bin, int $bis_per_char);

Internal bin_to_reable() function is not designed to reversible, i.e.
It cannot convert $readable_bin to $binary, because it does not care
trailing bits that cannot fit into a char. I need more info these
function to be reversible. i.e.

string str_reable2bin(string $readble_bin, int $bis_per_char, int
$number_of_bits_in_readble_bin);

These APIs do not look good to be usable...

I hope I explained well the reason behind to have session_create_id().

Regards,

P.S. I would like to change session_regenerate_id() accept 'prefix',
but it has 1st parameter that I would like to remove in the future.
This is the reason why I didn't change session_regenerate_id(). It
requires a lot less user code

session_rengenerate_id('myprefix-');

yet it is safe.

--
Yasuo Ohgaki
yohgaki@ohgaki.net