Hi Stas,
On Sun, Feb 2, 2014 at 8:59 AM, Yasuo Ohgaki <[email protected]> wrote:
> To set user defined session ID, user has to do
>
> ini_set('session.use_strict_mode', FALSE);
> session_id(session_create_id('SOME-USEFUL-PREFIX'));
>
> With this change, user could do
>
> session_id(session_create_id('SOME-USEFUL-PREFIX'));
>
> regardless of INI settings. session_id() is changed to modify
> 'session.use_strict_mode' INI to off internally. This change is not
> mandatory as user may change INI by themselves. It's for convenience. I
> don't mind at all withdrawing this change from the RFC.
>
Users might be setting unsafe session ID using session_id(), adding
optional $force_id parameter to session_id() is better.
$force_id = TRUE;
session_id(session_create_id('SOME-USEFUL-PREFIX'), $force_id);
It may prevent setting unsafe ID by mistake.
Regards,
--
Yasuo Ohgaki
[email protected]