Edit report at https://bugs.php.net/bug.php?id=77330&edit=1
ID: 77330
Comment by: e6990620 at gmail dot com
Reported by: e6990620 at gmail dot com
Summary: session_id() no longer works inside custom
SessionHandlerInterface
Status: Feedback
Type: Bug
Package: Session related
Operating System: Linux
PHP Version: 7.3.0
Assigned To: yohgaki
Block user comment: N
Private report: N
New Comment:
@yohgaki another version of the test script, with strict_mode enabled with ini_set: https://3v4l.org/pfKge
Previous Comments:
------------------------------------------------------------------------
[2019-01-17 10:42:55] e6990620 at gmail dot com
The way I see it it's a valid use case, though. A custom session handler that wants to conform
to strict mode needs some way to regenerate the session ID if the one received in the
read($session_id) method is not in the storage area, and that new ID must be passed down by the PHP
engine when it invokes write($session_id, $session_data). Calling session_id() in this context used
to achieve this, but I wasn't aware it was considered an abuse. Are there any other ways to do
the same?
Unrelatedly to this issue, I also believe that session.use_strict_mode should default to true, and
I'm glad to hear you are pushing in this direction.
------------------------------------------------------------------------
[2019-01-17 10:38:31] yohgaki@php.net
ext/session/tests/session_basic2.phpt is not failing, so reporter's 7.3 is not enabling
session.strict_mode. To reporter, please verify.
------------------------------------------------------------------------
[2019-01-17 10:26:10] yohgaki@php.net
Reporter, as documented in UPGRADING, PHP 7.3 has more precise session module state management.
Older session allowed abuses that can harm session and session module. PHP 7.3 disallowed these
harmful/broken usages. i.e. Any changes that can cause "side effect" are disallowed.
This code is trying to change active session state.
https://3v4l.org/6S4XM
Therefore, the code wouldn't work even with ob_start().
Session module was made to work even with harmful/broken usages, and it caused number of bad bugs in
the past.
public function read($session_id)
{
// Simulate a session ID regeneration.
\session_id('newsessionid');
return '';
}
This code is bad code because it is calling session_id() to set "new" id. Setting new ID
in user script for active sessions is bad because it has "side effect" to session module
internal. The "side effect" can break session. Detailed description is omitted.
Anyway, the code is broken. User cannot make any changes that can cause "side effect".
I'll check see if strict_mode is broken or not, since reporter claims that 7.3 allows session
fixation.
------------------------------------------------------------------------
[2019-01-17 10:16:27] e6990620 at gmail dot com
I can confirm that the session.use_strict_mode directive is disabled in all PHP versions (though
"strict mode" is actually enforced by the DemoBugSessionHandler code itself).
To verify this I just appended this line at the end of the test script in 3v4l:
echo ini_get('session.use_strict_mode') . PHP_EOL;
and reran.
------------------------------------------------------------------------
[2019-01-17 10:08:44] yohgaki@php.net
Ok thanks. I'll have a look to see what is going on.
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=77330
--
Edit this bug report at https://bugs.php.net/bug.php?id=77330&edit=1