Re: [RFC] [Discussion] Secure session_regenerate_id()
| From: | Yasuo Ohgaki | Date: | Thu, 20 Mar 2014 08:30:36 +0000 |
| Subject: | Re: [RFC] [Discussion] Secure session_regenerate_id() | ||
| References: | 1 2 3 4 5 6 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-73324@lists.php.net to get a copy of this message | ||
Hi Mateusz,
On Thu, Mar 20, 2014 at 5:23 PM, Mateusz Kocielski <shm@digitalsun.pl>wrote:
> > > I agree. But we've got more factors here, it's not a simple tool for
> > > detection
> > > of crimes. If we let "old session" live for x secs, what will happen to
> > > changes done to the old session? How do you want to resolve that? We
> should
> > > find a balance between complexity and security.
> > >
> > >
> > Currently we have poor mitigation. My proposal provides better
> mitigation.
>
> I still don't see how you want to handle inconsistency between sessions. It
> seems that your RFC silently ignores that issue.
I'm not sure which inconsistency. Could you specify/describe it?
Regards,
--
Yasuo Ohgaki
yohgaki@ohgaki.net