Re: [RFC] Secure Session Module Options by Default

From: Date: Sun, 02 Feb 2014 00:06:54 +0000
Subject: Re: [RFC] Secure Session Module Options by Default
References: 1 2 3  Groups: php.internals 
Request: Send a blank email to [email protected] to get a copy of this message
Hi Stas,

On Sun, Feb 2, 2014 at 8:59 AM, Yasuo Ohgaki <[email protected]> wrote:

> To set user defined session ID, user has to do
>
> ini_set('session.use_strict_mode', FALSE);
> session_id(session_create_id('SOME-USEFUL-PREFIX'));
>
> With this change, user could do
>
> session_id(session_create_id('SOME-USEFUL-PREFIX'));
>
> regardless of INI settings. session_id() is changed to modify
> 'session.use_strict_mode' INI to off internally. This change is not
> mandatory as user may change INI by themselves. It's for convenience. I
> don't mind at all withdrawing this change from the RFC.
>

Users might be setting unsafe session ID using session_id(), adding
optional $force_id parameter to session_id() is better.

$force_id = TRUE;
session_id(session_create_id('SOME-USEFUL-PREFIX'), $force_id);

It may prevent setting unsafe ID by mistake.

Regards,

--
Yasuo Ohgaki
[email protected]


Thread (30 messages)

« previous php.internals (#71956) next »