Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:96148
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.192.182 as permitted sender)
To: Yasuo Ohgaki <yohgaki@ohgaki.net>,
 "internals@lists.php.net" <internals@lists.php.net>
References: <CAGa2bXaX1eZS=_Xg3JjCVZRBSruMy6yUk-PTrKoGOwW5Tg=0_Q@mail.gmail.com>
 <CAGa2bXaApCEziTVDB3PA_MpBJLuYvKHGmiSy8XuuD1uARfYhvA@mail.gmail.com>
Message-ID: <36d925dc-f5a4-b6fb-1060-decf2c7f5271@gmail.com>
Date: Sun, 25 Sep 2016 23:18:39 -0700
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0)
 Gecko/20100101 Thunderbird/45.3.0
MIME-Version: 1.0
In-Reply-To: <CAGa2bXaApCEziTVDB3PA_MpBJLuYvKHGmiSy8XuuD1uARfYhvA@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Re: Fixing halfway implemented session management -
 timestamp based session management OR remove session_regenerate_id()
From: smalyshev@gmail.com (Stanislav Malyshev)

Hi!

> Please read session_regenerate_id() example #2.
> 
> Example #2 Avoiding lost session by session_regenerate_id()

In this example, why you do session_commit() in my_session_start()?
There's no point in writing stale session.

I also see no code that actually removes old sessions - is it by design?

I am also not sure why this code messes with session.use_strict_mode -
which user code is not supposed to do, this should be possible to do
without doing that.

In fact, thinking about it, I think the following can be done relatively
easily: make session_regenerate_id(), if called with false, to put magic
entries into old session that specify a) when it was regenerated and b)
what was the new session ID.

This would allow to implement example #2 in userspace much cleaner, and
if we want to implement it further in session, we could add option to
session_start to do so. But one could also use this data in your own
session system if one wants to do it slightly differently.

This still leaves the question of old sessions, but it's not new as
session_regenerate_id(false) already exists and in general we have GC.

--
Stas Malyshev
smalyshev@gmail.com