Re: [RFC] [Discussion] Secure session_regenerate_id()

From: Date: Thu, 20 Mar 2014 09:49:13 +0000
Subject: Re: [RFC] [Discussion] Secure session_regenerate_id()
References: 1 2 3 4 5 6 7 8 9 10  Groups: php.internals 
Request: Send a blank email to [email protected] to get a copy of this message
On Thu, Mar 20, 2014 at 11:26:13AM +0200, Andrey Andreev wrote:

> > This race condition will not change with or without my proposal.
> 
> Which is another reason to leave this to user code:
> 
> ajax_safe_regenerate_id($delete = TRUE)
> {
>     if ( ! empty($_SERVER['HTTP_X_REQUESTED_WITH']) &&
> strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) === 'xmlhttprequest')
>     {
>         return FALSE;
>     }
> 
>     return session_regenerate_id($delete);
> }

This is not going to work properly, there's still race. I think that the best
solution is to handle race on client side (send request once more on session
error).

 Kind Regrads,
 Mateusz Kocielski


Thread (23 messages)

« previous php.internals (#73331) next »