Re: [RFC] [Discussion] Secure session_regenerate_id()

From: Date: Thu, 20 Mar 2014 09:26:13 +0000
Subject: Re: [RFC] [Discussion] Secure session_regenerate_id()
References: 1 2 3 4 5 6 7 8 9  Groups: php.internals 
Request: Send a blank email to [email protected] to get a copy of this message
Hi,

>> Consider following scenario:
>>
>> 1. session_regenerate_id(..) is called
>> 2. request to /update_session with old session id is done (some key-value
>> in
>> session is changed) - with your change this request will succeed
>> --- from here user uses only new session -
>> 3. updated key-value is missing in new session
>>
>> (same scenario can be triggered now if old session is not deleted)
>
>
> This race condition will not change with or without my proposal.

Which is another reason to leave this to user code:

ajax_safe_regenerate_id($delete = TRUE)
{
    if ( ! empty($_SERVER['HTTP_X_REQUESTED_WITH']) &&
strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) === 'xmlhttprequest')
    {
        return FALSE;
    }

    return session_regenerate_id($delete);
}

Cheers,
Andrey.


Thread (23 messages)

« previous php.internals (#73329) next »