Bug #68063 [Csd]: Empty session IDs do still start sessions
Edit report at https://bugs.php.net/bug.php?id=68063&edit=1
ID: 68063
Updated by: yohgaki@php.net
Reported by: mail at thomasbachem dot com
Summary: Empty session IDs do still start sessions
Status: Closed
Type: Bug
Package: Session related
PHP Version: 5.5.17
Assigned To: yohgaki
Block user comment: N
Private report: N
New Comment:
To resolve this issue fully, previously mentioned RFC must be implemented and used. Otherwise, users
may experience random session reset on occasion.
Previous Comments:
------------------------------------------------------------------------
[2016-01-15 01:32:24] yohgaki@php.net
http://git.php.net/?p=php-src.git;a=commitdiff;h=8c37a086c78a66517967fcb809fb53297becfe42
Improved fix that ignores empty session ID is committed.
------------------------------------------------------------------------
[2016-01-12 22:28:54] yohgaki@php.net
The following patch has been added/updated:
Patch Name: bug68063.patch
Revision: 1452637734
URL: https://bugs.php.net/patch-display.php?bug=68063&patch=bug68063.patch&revision=1452637734
------------------------------------------------------------------------
[2016-01-12 22:27:21] yohgaki@php.net
Fix is committed already, but it's not appropriate.
if (PS(id) && !strlen(PS(id))) {
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot start session with empty session
ID");
RETURN_FALSE;
}
The reason why session ID became empty is browser's cookie handling. To workaround this,
session module should keep old session ID for a while.
https://wiki.php.net/rfc/precise_session_management
Session module should not raise error, but generate new when session ID cookie became empty.
------------------------------------------------------------------------
[2015-06-29 21:26:18] yohgaki@php.net
It seems I shouldn't raise error here.
Some clients send empty session ID sometimes in rare case. It's probably due to race condition
by session_regenerate_id(true). I got report this case from more than 10k RPM site.
One possible solution is create new session ID automatically when session ID is empty.
Another possible resolution is to implement lazy destruction of session data and not deleting old
session ID immediately. Related to https://bugs.php.net/bug.php?id=69127
Re-opened this bug for the time being.
------------------------------------------------------------------------
[2015-02-03 04:51:34] yohgaki@php.net
Automatic comment on behalf of yohgaki
Revision: http://git.php.net/?p=php-src.git;a=commit;h=853ae39d6ea6a4d2ce95098744e481a1e8573ad8
Log: Fixed bug #68063 Empty session IDs do still start sessions
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=68063
--
Edit this bug report at https://bugs.php.net/bug.php?id=68063&edit=1
Thread (8 messages)