Re: [VOTE] Secure Session Module Options/Internal by Default

Hi there, I remember that the use_strict_mode=on added in PHP 5.5 was broken and would prevent the application from setting a session ID by itself. This is actually fairly common, about 800k Drupal 7 websites do that. Unless this is fixed, this setting just cannot be enabled by default. Damien Tournoud On Mon, Feb 17, 2014 at 5:27 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote: > Hi all, > > This RFC changes default session settings and introduces a new > setting that disables possible timing attack against session ID. All > of them help to improve general session ID security except > hash_bits_per_character change. > > NIST discourages use of SHA-1 years ago. It proposes to use > SHA-256 as the default hash function for session. To reduce > size of session ID string, hash_bits_per_character=6 is proposed. > > https://wiki.php.net/rfc/secure-session-options-by-default > > Thank you for voting! > > P.S. Although, the change is trivial, if anyone would like to see > patch for this, I'll prepare one ASAP. > > -- > Yasuo Ohgaki > yohgaki@ohgaki.net >