Re: Regenerating session ID automatically when IP address has changed
| From: | Sanford Whiteman | Date: | Thu, 26 Sep 2013 22:57:52 +0000 |
| Subject: | Re: Regenerating session ID automatically when IP address has changed | ||
| References: | 1 2 3 4 5 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-69362@lists.php.net to get a copy of this message | ||
> Users who are concerned for this situation should disable it. Users
> who are concerned security should accept this case.
I assume "users" are as we understand them here, i.e. me.
But as a developer-user I would likely want to empower my end-users to
turn off this feature themselves. With high-volume sites (not that I
really have any anymore, but a guy can dream) there isn't going to be
a one-size-fits-all regarding connection quality, but there can be a
default INI setting and then a function that we can call to override
it. Paranoid users will turn/leave it on.... any user in a sketchy
connection situation will turn it off (per session or for all their
future sessions).
Which is kind of why this is sounding more and more like a nice
discussion... about a userland solution.
-- S.