rfc:session-create-id
Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revisionNext revisionBoth sides next revision | ||
rfc:session-create-id [2016/08/10 08:41] – Update description a little yohgaki | rfc:session-create-id [2016/09/01 01:37] – Update merged version yohgaki | ||
---|---|---|---|
Line 2: | Line 2: | ||
* Version: 0.1 | * Version: 0.1 | ||
* Created Date: 2016-04-07 | * Created Date: 2016-04-07 | ||
- | * Modified Date: 2016-04-07 | + | * Modified Date: 2016-08-10 |
* Author: Yasuo Ohgaki < | * Author: Yasuo Ohgaki < | ||
- | * Status: | + | * Status: |
* First Published at: http:// | * First Published at: http:// | ||
===== Introduction ===== | ===== Introduction ===== | ||
- | Session ID is created by session internal | + | Session ID is created by session internal |
===== Proposal ===== | ===== Proposal ===== | ||
Line 20: | Line 20: | ||
session_create_id() will create new session ID by | session_create_id() will create new session ID by | ||
- | * Default internal function(php_session_create_id()) when session is not active. | + | * Default internal function(php_session_create_id()) when session is **NOT** |
- | * User defined session ID creation function when session is active. | + | * Save handler |
+ | * Additionally, | ||
- | Session ID collision is detected upon session_start(). Therefore, different session ID could be assigned by collision and session.use_strict_mode=1. | + | Note: User defined session ID creation function(handler) |
- | + | ||
- | Note: Session ID creation function | + | |
http:// | http:// | ||
- | It's not documented because Object based save handler has non standard method name. i.e. create_sid() rather than createSid(). Rename will be proposed by different RFC. If you would like to see how it is used, please refer to phpt files. | + | <del>It's not documented because Object based save handler has non standard method name. i.e. create_sid() rather than createSid(). Rename will be proposed by different RFC.</ |
* https:// | * https:// | ||
Line 60: | Line 59: | ||
// Set your own session ID and start session. | // Set your own session ID and start session. | ||
session_id($sid); | session_id($sid); | ||
- | // Collision is checked already in previous active session. | + | // Collision is checked already in previous active session. |
- | | + | |
session_start(); | session_start(); | ||
| | ||
Line 87: | Line 85: | ||
If session data is stored in database, administrators are able to list active session per uid easily and efficiently. | If session data is stored in database, administrators are able to list active session per uid easily and efficiently. | ||
+ | |||
+ | ===== Discussions ===== | ||
+ | |||
+ | == Should have str_bin2readable() instead of session_create_id() == | ||
+ | |||
+ | Internal php_bin_to_readable() function that converts binary to chars has issues. | ||
+ | - It's not designed to reversible. i.e. str_readable2bin() is not possible. It cannot be implemented usable way at least. | ||
+ | - session_create_id() is mandatory function for session ID validation enabled user save handlers. There should be default session ID creation function. Otherwise, users have to implement by themselves and users could easily implement improper or broken session_create_id() function. | ||
+ | |||
+ | == User land session_create_id() is easy == | ||
+ | |||
+ | It would be easy with quick, dirty and insecure way. However, proper, precise and compatible session_create_id() is complex to do the exactly what proposed session_create_id() does. | ||
+ | |||
+ | <code php> | ||
+ | function session_create_id(string $prefix) | ||
+ | { | ||
+ | $encoded = base64_encode(random_bytes(ini_get(' | ||
+ | // Use same charset as PHP | ||
+ | $sid = substr(rtrim(strtr($encoded, | ||
+ | ini_get(' | ||
+ | // This code does not consider session.hash_bits_per_character. | ||
+ | // It must be handled also, but omitted here. | ||
+ | // In addition, above code reduces session ID security by | ||
+ | // eliminating certain patterns of bits. i.e. Removing | ||
+ | // certain chars in BASE64 encoding string removes certain | ||
+ | // patterns of bits. As a result, randomness of session ID | ||
+ | // is spoiled. | ||
+ | |||
+ | $sid .= $prefix; | ||
+ | |||
+ | // Now validate SID so that it does not have collisions | ||
+ | when session is active, connect to database and validate SID | ||
+ | try to fetch sid | ||
+ | if sid is there | ||
+ | try again to generate SID few times | ||
+ | if SID validation failed | ||
+ | fatal error | ||
+ | return safe SID | ||
+ | when session is inactive | ||
+ | return unvalidated SID | ||
+ | } | ||
+ | </ | ||
+ | |||
+ | Something like above code is **required** to implement recommended user session save handlers currently. | ||
+ | |||
+ | == The default 128 bits Session ID is large enough to ignore collisions == | ||
+ | |||
+ | Brute force session ID hijack risk is described here. | ||
+ | https:// | ||
+ | |||
+ | The expected number of seconds required to guess a valid session | ||
+ | identifier is given by the equation: | ||
+ | | ||
+ | (2^B+1)/ | ||
+ | | ||
+ | Where: | ||
+ | | ||
+ | B is the number of bits of entropy in the session identifier | ||
+ | A is the number of guesses an attacker can try each second | ||
+ | S is the number of valid session identifiers that are valid and | ||
+ | available to be guessed at any given time | ||
+ | |||
+ | It says | ||
+ | |||
+ | '' | ||
+ | |||
+ | 292 years may sound long enough. However, even though the document explicitly does not states " | ||
+ | |||
+ | Let me paraphrase OWASP' | ||
+ | |||
+ | '' | ||
+ | |||
+ | NOTE: It's about probability. Expectation is "on average" | ||
+ | |||
+ | Assumption for security should be pessimistic. OWASP makes pessimistic assumption for entropy in session ID, probably because proving " | ||
+ | |||
+ | 10M active sessions are possible even with relatively small sites because there are users who use very long session ID life time for "auto login" | ||
+ | |||
+ | In addition to above, current session management implementation does not support timestamp based session data management. i.e. https:// | ||
+ | |||
+ | Somebody wins lottery. Even 1 in millions/ | ||
+ | |||
+ | If there are users who really do not want collision detection at all, they should do it by their own responsibility and risk. e.g. | ||
+ | |||
+ | <code php> | ||
+ | if (session_status() == PHP_SESSION_ACTIVE) { | ||
+ | session_commit(); | ||
+ | } | ||
+ | ini_set(' | ||
+ | // NIST requires SHA2 or better hash for collision sensitive usage. | ||
+ | $new_sid = hash(' | ||
+ | session_id($new_sid); | ||
+ | session_start() | ||
+ | </ | ||
===== Backward Incompatible Changes ===== | ===== Backward Incompatible Changes ===== | ||
- | None. | + | None. Just a new function. |
===== Proposed PHP Version(s) ===== | ===== Proposed PHP Version(s) ===== | ||
- | PHP 7.1 | + | PHP 7.2 |
===== Voting Choices ===== | ===== Voting Choices ===== | ||
Line 101: | Line 193: | ||
This project requires a 2/3 majority | This project requires a 2/3 majority | ||
- | <doodle title=" | + | <doodle title=" |
* Yes | * Yes | ||
* No | * No | ||
Line 115: | Line 207: | ||
After the project is implemented, | After the project is implemented, | ||
- the version(s) it was merged to | - the version(s) it was merged to | ||
+ | - PHP 7.1 and master (Merged to 7.1 also by RM permission) | ||
- a link to the git commit(s) | - a link to the git commit(s) | ||
+ | - http:// | ||
- a link to the PHP manual entry for the feature | - a link to the PHP manual entry for the feature | ||
+ | - http:// | ||
===== References ===== | ===== References ===== |
rfc/session-create-id.txt · Last modified: 2020/03/26 12:47 by cmb