Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Redis session missing checking for setting of wrong session id (FIXING PATCH INSIDE) #88

@misterion

Description

@misterion

Using file or sql-lile session storage you got the warning if try to set empty session id.
Try this code

<?php
ini_set('error_reporting', E_ALL);

session_start();

echo 'before id=' . session_id() . PHP_EOL;
session_id("");
echo 'after id=' . session_id() . PHP_EOL;

The result is 'Warning: Unknown: The session id is too long or contains illegal characters, valid characters are a-z, A-Z, 0-9 and '-,' in Unknown on line 0'

So at least you have a chance to locate problem in code and fix it. Using redis session you haven`t got this warning.

But the most important is the next thing.

<?php
ini_set('error_reporting', E_ALL);

echo 'before id=' . session_id() . PHP_EOL;
var_export(session_id(""));
session_start();
echo 'after id=' . session_id() . PHP_EOL;

Using original php handler you got something like this:

before id=
''
Warning: session_start(): The session id is too long or contains illegal characters, valid characters are a-z, A-Z, 0-9 and '-,' in /path_to_sample/file.php on line 8

Call Stack:
    0.0005     327912   1. {main}() /path_to_sample/file.php:0
    0.0006     328032   2. session_start() /path_to_sample/file.php:8

after id=o37rffe3fn3vuuq4vmkcpe0686

but with redis session you got the empty session which would be set to client!!!

Metadata

Metadata

Assignees

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions