Re: [VOTE] Secure Session Module Options/Internal by Default
| From: | Yasuo Ohgaki | Date: | Fri, 21 Feb 2014 00:15:13 +0000 |
| Subject: | Re: [VOTE] Secure Session Module Options/Internal by Default | ||
| References: | 1 2 3 4 5 6 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-72727@lists.php.net to get a copy of this message | ||
Hi Tjerk,
On Tue, Feb 18, 2014 at 8:58 PM, Tjerk Meesters <tjerk.meesters@gmail.com>wrote:
> In that case, the RFC should be updated with the corresponding commit logs
> (part of the process) when it was merged with the project; this makes it
> easier to discuss historical commits based on it.
Thank you for point it out.
I'll update the RFC. If document is not updated, I'll update it, too.
Regarding session_id() behavior, it could be made to accept user specified
session ID independent of "use_strict_mode". To accept user specified
session ID when "use_strict_mode=on", there should be an API that generates
secure session ID. Otherwise, user may create insecure ID and set it.
Any call for RFC, anyone? I'm willing to propose this.
--
Yasuo Ohgaki
yohgaki@ohgaki.net