Edit report at https://bugs.php.net/bug.php?id=69127&edit=1
ID: 69127
Updated by: [email protected]
Reported by: rbsimao at yahoo dot com dot br
Summary: session_regenerate_id(true) randomly generates a
warning and loses session data
-Status: Verified
+Status: Analyzed
Type: Bug
Package: Session related
Operating System: Any
PHP Version: Any
Assigned To: yohgaki
Block user comment: N
Private report: N
Previous Comments:
------------------------------------------------------------------------
[2015-09-29 02:07:14] [email protected]
Related RFC
https://wiki.php.net/rfc/precise_session_management
------------------------------------------------------------------------
[2015-09-19 23:41:17] [email protected]
Procedure to reproduce this issue
test.php
--------------
<?php
ob_start();
session_start();
echo "<pre>";
var_dump(session_id(),
$_SESSION['v']++);
session_regenerate_id(true);
var_dump(session_id());
?>
--------------
Start CLI server
$ php -S 127.0.0.1:8888
Access test.php and press F5 few minutes
http://127.0.0.1:8888/test.php
You'll see counter value ($_SESSION['v']) is resetted sometimes.
PHP 7.0 git + Fedora 22 + Chrome 45.0.2454.93 (64-bit) : Easy to reproduce. Thousands of requests are enough.
PHP 7.0 git + Fedora 22 + Firefox 40.0.3 : Very hard to reproduce. Tens of thousands of requests are required.
CLI server process requests one by one. The reason why there is difference would be how browser locks cookie data. It seems Chrome locking is more lazy or no locks at all. (BTW, even if browser locks cookie strictly, lost packet/etc could cause lost session. Therefore, "eventually consistent" approach is required for reliable HTTP session management.)
Let me know if you(anyone) could reproduce the bug or not by this procedure - PHP version, OS name/version, Browser name/version and easiness/hardness of reproducibility.
------------------------------------------------------------------------
[2015-05-24 06:22:13] [email protected]
This bug is related to
https://bugs.php.net/bug.php?id=65746
------------------------------------------------------------------------
[2015-02-27 05:00:31] [email protected]
This is known issue and I proposed fix for this.
However, there are people who do not like my proposal.
Since session data and browser is not synced, session module must handle session_regenerate_id(true) in async way. This is what I proposed before.
I shall try to fix this again. Thank you for reporting.
------------------------------------------------------------------------
[2015-02-26 18:05:05] rbsimao at yahoo dot com dot br
Description:
------------
---
From manual page: http://www.php.net/function.session-regenerate-id
---
The piece of code below works ok most of the time. Randomly it does not work: session_regenerate_id(true) issues a warning saying it could not delete the old session data. But the session file is there and the permissions are untouched. Also, when it issues the warning, all the session data is lost on the new generated session.
Tested on ubuntu11 to ubuntu14 with default phps and windows 7/php5.5.
Test script:
---------------
<?php
session_start();
session_regenerate_id(true);
session_write_close();
?>
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=69127&edit=1
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.