session_regenerate_id(true) by default
| From: | Yasuo Ohgaki | Date: | Tue, 22 Oct 2013 06:53:58 +0000 |
| Subject: | session_regenerate_id(true) by default | ||
| Groups: | php.internals | ||
| Request: | Send a blank email to internals+get-69739@lists.php.net to get a copy of this message | ||
Hi all,
Without 'true', session_regenerate_id() will not delete old session data
which may contain sensitive data. It was made to 'false' by default for
users relying on the bug. (PHP 4.x, IIRC)
Almost all users should call session_regenerate_id() with 'true' parameter.
Therefore, I would like to suggest make it 'true' by default from next PHP.
Any comments?
--
Yasuo Ohgaki
yohgaki@ohgaki.net