Re: [RFC] Secure Session Module Options by Default
| From: | Yasuo Ohgaki | Date: | Sun, 02 Feb 2014 00:06:54 +0000 |
| Subject: | Re: [RFC] Secure Session Module Options by Default | ||
| References: | 1 2 3 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-71956@lists.php.net to get a copy of this message | ||
Hi Stas,
On Sun, Feb 2, 2014 at 8:59 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> To set user defined session ID, user has to do
>
> ini_set('session.use_strict_mode', FALSE);
> session_id(session_create_id('SOME-USEFUL-PREFIX'));
>
> With this change, user could do
>
> session_id(session_create_id('SOME-USEFUL-PREFIX'));
>
> regardless of INI settings. session_id() is changed to modify
> 'session.use_strict_mode' INI to off internally. This change is not
> mandatory as user may change INI by themselves. It's for convenience. I
> don't mind at all withdrawing this change from the RFC.
>
Users might be setting unsafe session ID using session_id(), adding
optional $force_id parameter to session_id() is better.
$force_id = TRUE;
session_id(session_create_id('SOME-USEFUL-PREFIX'), $force_id);
It may prevent setting unsafe ID by mistake.
Regards,
--
Yasuo Ohgaki
yohgaki@ohgaki.net