Re: why does PHP accept [new] session ids from client?

From: Date: Thu, 31 Mar 2005 17:13:22 +0000
Subject: Re: why does PHP accept [new] session ids from client?
References: 1 2 3 4  Groups: php.internals 
Request: Send a blank email to internals+get-15701@lists.php.net to get a copy of this message
M. Sokolewicz wrote:
"why is it this way" should also be posted to the general newsgroup, it barely has anything to do with internals
The behavior of the session extension has everything to do with internals. I'm not sure why everyone is sending him to php-general. No one there is going to be able to change this behavior. They can only suggest userland code to try to work around it. The problem is that PHP uses any user-supplied session identifier when creating a new session. This increases the risk of session fixation. If this behavior were changed, it would not completely protect developers from session fixation, but it would be a step in the right direction. I think the original poster was making this suggestion. Chris

« previous php.internals (#15701) next »