Re: Strict session?
| From: | Yasuo Ohgaki | Date: | Wed, 23 Nov 2011 14:03:55 +0000 |
| Subject: | Re: Strict session? | ||
| References: | 1 2 3 4 5 6 7 8 9 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-56503@lists.php.net to get a copy of this message | ||
Hi Stats,
Thanks to Perrie, I realized I should try to this patch to be accepted
for 5.4 branch.
As you may already knew, session adoption is "real" threat for PHP
applications. Therefore, this patch should be in 5.4.0 for better
security.
In case of you've missed why session adoption is real threat for PHP
applications, please try to set the same cookies to various path and
domains. Then check and compare the result with IE and Chrome/Firefox.
This patch is really needed for PHP.
Regards,
--
Yasuo Ohgaki
yohgaki@ohgaki.net