Re: [RFC] [Discussion] Secure session_regenerate_id()
| From: | Mateusz Kocielski | Date: | Thu, 20 Mar 2014 08:23:46 +0000 |
| Subject: | Re: [RFC] [Discussion] Secure session_regenerate_id() | ||
| References: | 1 2 3 4 5 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-73322@lists.php.net to get a copy of this message | ||
On Thu, Mar 20, 2014 at 03:33:09AM +0900, Yasuo Ohgaki wrote:
> > I agree. But we've got more factors here, it's not a simple tool for
> > detection
> > of crimes. If we let "old session" live for x secs, what will happen to
> > changes done to the old session? How do you want to resolve that? We should
> > find a balance between complexity and security.
> >
> >
> Currently we have poor mitigation. My proposal provides better mitigation.
I still don't see how you want to handle inconsistency between sessions. It
seems that your RFC silently ignores that issue.
Kind Regards,
Mateusz Kocielski