Re: Session IP address matching

Hi Stas, On Sun, Jan 26, 2014 at 9:44 AM, Stas Malyshev <smalyshev@sugarcrm.com>wrote: > > which is really bad thing to do. session_create_id() generate ID using > > the same code PHP generates ID which is much secure than above and > > supposed to be faster than user land script. > > I agree that exposing the ID creation function is a good addition > (actually if it was available I'd probably use it in other contexts > where I need a random token, not necessarily a session ID as such). > Maybe we need even more generic function and have session reuse that > code, too. Although I've written it already, I appreciate any comments for improvement. Do you have idea for session_create_id()? Perhaps, more generic function name and/or move to ext/standard? For more generic ID or token, I think we need UUID module. If there is a module available, we are better to include it. I think someone is working on it. Regards, -- Yasuo Ohgaki yohgaki@ohgaki.net