Re: Solution for session_regenerate_id() issues

Hi all, Before I start working on revised session module improvement patch, I would like to address session_regenerate_id() issue. On Thu, Mar 13, 2014 at 1:03 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote: > Current session_regenerate_id() has issues. I'll try to explain what these > are. > > Issue 1: Old session data is not deleted. > > session_regenerate_id() does not delete old session by default. It leaves > old session available. When attacker could steal session ID via > XSS/sniffing/etc, attacker can use session ID as valid ID as long as > application allows. No detection/prevention of security breach is possible > at session module level. This behavior is unacceptable for security reason. > > Issue 2: Old session data cannot be deleted. > > session_regenerate_id(TRUE) deletes old session data immediately. It's > good for security, but if there are multiple connections from a client to > server (e.g. AJAX/iframe/tabs/etc), valid connection may fail since it > could be using old session ID. Therefore, session_regenerate_id() does not > delete old session data. Immediate session data deletion is unacceptable > for reliable operation. > > To solve these 2 issues, we need to delay old session data deletion. > Delete old session data 60 seconds later, for example. > > If there is any other feasible solutions are welcome. I cannot think of > any. > Current behavior (leaving active session that attackers may be abusing) is far from optimal. I can only think of delayed deletion as the solution for this. Delayed session deletion implementation has 2 options. (Introducing separate API has severe overheads. Thus, it's not an option) - set and check time stamp in $_SESSION. (Keep save handler/serializer compatibility) - set and check time stamp in raw session data. (Need save handler/serializer modification) This is "must be fixed" design problem for new release. IMHO. I don't mind which new release, but this should be fixed someday. Regards, -- Yasuo Ohgaki yohgaki@ohgaki.net