Req #73180 [Asn]: session_id() should be able to set new session ID always

Edit report at https://bugs.php.net/bug.php?id=73180&edit=1 ID: 73180 Updated by: yohgaki@php.net Reported by: yohgaki@php.net Summary: session_id() should be able to set new session ID always Status: Assigned Type: Feature/Change Request Package: Session related Operating System: Irrelevant PHP Version: Irrelevant Assigned To: yohgaki Block user comment: N Private report: N New Comment: Strict mode responsibility is "Making sure to provide _secure_ session ID that is generated by session module." I understand there are usages for "Fixed session ID". However, code like this session_id('aaaaaaaaaaaaaaaa'); is serious security threat. So perhaps, flag for "insecure session id"? session_id($new_id [bool $use_possibly_insecure_user_suppiled_id = FALSE]); e.g. session_id('insecure_id_but_i_want_it', true); Previous Comments: ------------------------------------------------------------------------ [2018-11-23 04:53:37] krozinov at gmail dot com I am seeing the same issue on Ubuntu 16.04 with: PHP 7.2.12-1+ubuntu16.04.1+deb.sury.org+1 (cli) (built: Nov 12 2018 09:55:12) ( NTS ) Copyright (c) 1997-2018 The PHP Group Zend Engine v3.2.0, Copyright (c) 1998-2018 Zend Technologies with Zend OPcache v7.2.12-1+ubuntu16.04.1+deb.sury.org+1, Copyright (c) 1999-2018, by Zend Technologies ------------------------------------------------------------------------ [2016-09-27 08:50:31] yohgaki@php.net Description: ------------ session_id() cannot set new session ID unless session.use_strict_mode=Off. session_id() should be able to set new session ID regardless of session.use_strict_mode. Test script: --------------- <?php session_id('aaaaaaaaaaaaaaaa'); session_start(); var_dump(session_id()); ?> Expected result: ---------------- string(16) "aaaaaaaaaaaaaaaa" Actual result: -------------- string(26) "qr2dhbblded4d63im663l6o8g0" ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=73180&edit=1