Re: [VOTE] Introduce session.lock, session.lazy_write and session.lazy_destory
| From: | Yasuo Ohgaki | Date: | Mon, 20 Jan 2014 12:07:07 +0000 |
| Subject: | Re: [VOTE] Introduce session.lock, session.lazy_write and session.lazy_destory | ||
| References: | 1 2 3 4 5 6 7 8 9 10 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-71322@lists.php.net to get a copy of this message | ||
Hi Stas,
On Mon, Jan 20, 2014 at 7:30 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> On Mon, Jan 20, 2014 at 6:17 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
>
>> I'll send mail when I finish editing the RFC, please hold to vote.
>
>
> Before I re-open vote, I would like to ensure if the RFC has no
> issues to discuss.
>
> https://wiki.php.net/rfc/session-lock-ini
>
> Thank you for reviewing RFC!
I was forgetting whole point of having session.lazy_destroy.
This feature should be enabled by default to destroy old session
when session_regenerate_id() is called.
Regenerating session ID with reliable manner is mandatory for
better security. Therefore, I've changed RFC to enable session.lazy_destroy
by default. Default delay is matter to discuss, though.
Please refer to the referenced discussion in the RFC.
http://marc.info/?l=php-internals&m=138242492914526&w=2
Regards,
--
Yasuo Ohgaki
yohgaki@ohgaki.net