Re: Session Id Collisions
| From: | Yasuo Ohgaki | Date: | Mon, 05 Aug 2013 10:10:14 +0000 |
| Subject: | Re: Session Id Collisions | ||
| References: | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-68375@lists.php.net to get a copy of this message | ||
Hi Arpad,
On Mon, Aug 5, 2013 at 7:05 PM, Arpad Ray <arraypad@gmail.com> wrote:
> I'm not against the idea in principle but still think having a security
> feature which just quietly fails if you're not using one of two modified
> handlers is really not good.
>
> I also think there's no great rush to add this, because as you say, it can
> be protected against in userland too.
>
> I would much rather have a robust, clean solution even if we have to wait
> until php.next for it.
>
As I wrote, we already had long discussion a year ago and decided to
include maintained branches.
This issue should be fixed 8 years ago. It's already too late to adopt IMHO.
If you would like to know the details of risks, please refer to the RFC.
Regards,
--
Yasuo Ohgaki
yohgaki@ohgaki.net