[VOTE] Secure Session Module Options/Internal by Default

Hi all, This RFC changes default session settings and introduces a new setting that disables possible timing attack against session ID. All of them help to improve general session ID security except hash_bits_per_character change. NIST discourages use of SHA-1 years ago. It proposes to use SHA-256 as the default hash function for session. To reduce size of session ID string, hash_bits_per_character=6 is proposed. https://wiki.php.net/rfc/secure-session-options-by-default Thank you for voting! P.S. Although, the change is trivial, if anyone would like to see patch for this, I'll prepare one ASAP. -- Yasuo Ohgaki yohgaki@ohgaki.net