Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:96142
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.161.177 as permitted sender)
Content-Type: text/plain; charset=iso-8859-1
Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\))
In-Reply-To: <20160925214039.E4C4E1A84473@dd1730.kasserver.com>
Date: Sun, 25 Sep 2016 17:12:50 -0500
Cc: internals@lists.php.net,
 yohgaki@ohgaki.net
Content-Transfer-Encoding: quoted-printable
Message-ID: <4FE8FD9E-3F86-4DFA-B201-F178F7FA143E@gmail.com>
References: <CAGa2bXaX1eZS=_Xg3JjCVZRBSruMy6yUk-PTrKoGOwW5Tg=0_Q@mail.gmail.com> <20160925214039.E4C4E1A84473@dd1730.kasserver.com>
To: Thomas Bley <mails@thomasbley.de>
Subject: Re: [PHP-DEV] Fixing halfway implemented session management - timestamp based session management OR remove session_regenerate_id()
From: pmjones88@gmail.com (Paul Jones)


> On Sep 25, 2016, at 16:40, Thomas Bley <mails@thomasbley.de> wrote:
>=20
> why not have a new session module? those who want no change for =
existing applications keep the old one, new projects can use the new =
one, those who want more security port their code to the new one. e.g. =
use session2_start(), etc.

If that's going to be the approach (and I find it appealing) then =
perhaps there should be other things accomplished as part of the new =
work; e.g., disable the automatic sending of cookie headers and make it =
explicit. Or wrap all the features in objects. (I don't want to =
volunteer anyone else for more work, though, and I myself am not =
competent to implement those ideas.)


--=20

Paul M. Jones
http://paul-m-jones.com