Re: Removing SQLite sessions from the defaultdistribution
| From: | Wez Furlong | Date: | Tue, 01 Jul 2003 23:57:58 +0000 |
| Subject: | Re: Removing SQLite sessions from the defaultdistribution | ||
| References: | 1 2 3 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-3135@lists.php.net to get a copy of this message | ||
----- Original Message -----
From: "Sterling Hughes" <sterling@bumblebury.com>
To: <ilia@prohost.org>
Cc: <internals@lists.php.net>
Sent: Tuesday, July 01, 2003 9:51 PM
Subject: Re: [PHP-DEV] Removing SQLite sessions from the defaultdistribution
> > 4) Marginally more secure then plain files
>
> Not at all. :) More files more better, you can have different
> permissions on each file, rather than the neive implementation of using
> one file for all sessions. Sure you can use save_path per virtual host,
> but that's if you do it. The default implementation is less secure, and
> that's what we have to count on.
Bullshit again.
You can have a session database per vhost and configure the permission of
that database per-vhost.