Edit report at https://bugs.php.net/bug.php?id=77330&edit=1
ID: 77330
Updated by: cmb@php.net
Reported by: e6990620 at gmail dot com
Summary: session_id() no longer works inside custom
SessionHandlerInterface
-Status: Open
+Status: Assigned
Type: Bug
Package: Session related
Operating System: Linux
PHP Version: 7.3.0
-Assigned To:
+Assigned To: yohgaki
Block user comment: N
Private report: N
New Comment:
This behavioral change has been introduced by merging pull request
2406[1]. Yasuo, can you please have a look at this? There will
also be a warning, if the session ID is changed in
SessionHandlerInterface::open().
[1] <https://github.com/php/php-src/pull/2406>
Previous Comments:
------------------------------------------------------------------------
[2018-12-20 21:10:38] e6990620 at gmail dot com
Description:
------------
Up until PHP 7.3.0 when you wrote a custom SessionHandlerInterface you could signal the PHP engine
to regenerate the ID by calling session_id('newvalue') inside its read() method. Then,
when the session closed and the engine calls the write() method, $session_id used to be the new
value.
Starting from PHP 7.3.0 this pattern no longer works, as write() receives the stale value.
Might be related to https://bugs.php.net/bug.php?id=74941 since it is
the only session-related change in this new major release.
Another bug report of the same issue in a real world session handler: https://github.com/1ma/RedisSessionHandler/issues/11
Test script:
---------------
https://3v4l.org/6S4XM
Expected result:
----------------
$ curl -i -H "Cookie: PHPSESSID=madeupkey;" localhost/bug.php;
HTTP/1.1 200 OK
Server: nginx/1.13.12
Date: Thu, 20 Dec 2018 20:51:23 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/7.2.13 <------------ PHP 7.2
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
newsessionid
Actual result:
--------------
$ curl -i -H "Cookie: PHPSESSID=madeupkey;" localhost/bug.php;
HTTP/1.1 200 OK
Server: nginx/1.13.12
Date: Thu, 20 Dec 2018 20:51:25 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/7.3.0 <------------ PHP 7.3
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
madeupkey <------ successful session fixation attack
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=77330&edit=1