Req #65746 [Ana]: session_regenerate_id() should not delete old session data immediately.

From:	yohgaki@php.net	Date:	Mon, 17 Oct 2016 06:38:12 +0000
Subject:	Req #65746 [Ana]: session_regenerate_id() should not delete old session data immediately.
References:	1	Groups:	php.bugs
Request:	Send a blank email to php-bugs+get-204837@lists.php.net to get a copy of this message

Edit report at https://bugs.php.net/bug.php?id=65746&edit=1

 ID:                 65746
 Updated by:         yohgaki@php.net
 Reported by:        yohgaki@php.net
-Summary:            session_regenerate_id() does not delete old session
                     data.
+Summary:            session_regenerate_id() should not delete old
                     session data immediately.
 Status:             Analyzed
 Type:               Feature/Change Request
 Package:            Session related
 PHP Version:        5.5Git-2013-09-23 (Git)
 Assigned To:        yohgaki
 Block user comment: N
 Private report:     N

 New Comment:

Use proper title. Original title meant "no deletion by __default__".
Last RFC is declined, but we _MUST_ fix this issue.

session_regenerate_id() depreciation is a option. We shouldn't keep security related broken
function.


Previous Comments:
------------------------------------------------------------------------
[2015-09-29 02:07:59] yohgaki@php.net

Related RFC
https://wiki.php.net/rfc/precise_session_management

------------------------------------------------------------------------
[2015-07-11 20:45:00] ab@php.net

Related To: Bug #70013

------------------------------------------------------------------------
[2015-05-24 06:21:56] yohgaki@php.net

Patch was there, but there are some objections for lazy destroy. I think there is no objection now.

This bug is related to 
https://bugs.php.net/bug.php?id=69127

------------------------------------------------------------------------
[2014-03-12 11:44:18] narf at devilix dot net

Huh, well ... it was last discussed 4 months ago and the RFC hasn't been updated since.

------------------------------------------------------------------------
[2014-03-12 06:43:25] yohgaki@php.net

Unfortunately no.
To delete old session properly, old session data should be deleted after a while. This behavior is
under discussion now.

------------------------------------------------------------------------


The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at

    https://bugs.php.net/bug.php?id=65746


--
Edit this bug report at https://bugs.php.net/bug.php?id=65746&edit=1


   

Thread (20 messages)

• yohgaki@php.netMon, 23 Sep 2013 22:41:35 +0000
  • requinix@php.netMon, 23 Sep 2013 23:17:06 +0000Bug #65746 [Asn]: session_regenerate_id() do not delete old session data.
  • yohgaki@php.netTue, 24 Sep 2013 01:02:29 +0000Bug->Req #65746 [Asn]: session_regenerate_id() do not delete old session data.
  • narf at devilix dot netThu, 06 Mar 2014 15:26:59 +0000Req #65746 [Com]: session_regenerate_id() do not delete old session data.
  • yohgaki@php.netWed, 12 Mar 2014 06:43:26 +0000Req #65746 [Asn]: session_regenerate_id() do not delete old session data.
  • narf at devilix dot netWed, 12 Mar 2014 11:44:19 +0000Req #65746 [Com]: session_regenerate_id() do not delete old session data.
  • yohgaki@php.netSun, 24 May 2015 06:21:57 +0000Req #65746 [Asn]: session_regenerate_id() do not delete old session data.
  • yohgaki@php.netTue, 29 Sep 2015 02:08:00 +0000Req #65746 [Asn]: session_regenerate_id() do not delete old session data.
  • yohgaki@php.netTue, 29 Dec 2015 00:30:43 +0000Req #65746 [Asn->Ana]: session_regenerate_id() do not delete old session data.
  • yohgaki@php.netMon, 17 Oct 2016 06:38:12 +0000Req #65746 [Ana]: session_regenerate_id() should not delete old session data immediately.
  • kalle@php.netTue, 24 Oct 2017 03:06:04 +0000Req #65746 [Ana->Asn]: session_regenerate_id() should not delete old session data immediately.
  • tony at marston-home dot demon dot co dot ukThu, 31 May 2018 09:01:42 +0000Req #65746 [Com]: session_regenerate_id() should not delete old session data immediately.
  • yohgaki@php.netThu, 31 May 2018 11:34:35 +0000Req #65746 [Asn]: session_regenerate_id() should not delete old session data immediately.
  • yohgaki@php.netThu, 31 May 2018 11:51:47 +0000Req #65746 [Asn]: session_regenerate_id() should not delete old session data immediately.
  • tony at marston-home dot demon dot co dot ukThu, 31 May 2018 12:03:25 +0000Req #65746 [Com]: session_regenerate_id() should not delete old session data immediately.
  • yohgaki@php.netFri, 01 Jun 2018 10:50:34 +0000Req #65746 [Asn]: session_regenerate_id() should not delete old session data immediately.
  • tony at marston-home dot demon dot co dot ukFri, 01 Jun 2018 11:03:19 +0000Req #65746 [Com]: session_regenerate_id() should not delete old session data immediately.
  • yohgaki@php.netSat, 02 Jun 2018 08:35:18 +0000Req #65746 [Asn]: session_regenerate_id() should not delete old session data immediately.
  • yohgaki@php.netSat, 02 Jun 2018 08:49:42 +0000Req #65746 [Asn]: session_regenerate_id() should not delete old session data immediately.
  • mydailyfashionblog0 at gmail dot comSun, 18 Jun 2023 07:16:30 +0000Req #65746 [Com]: session_regenerate_id() should not delete old session data immediately.