Spam sessions to DB

[Yuriy-Svetlov]

What steps will reproduce the problem?

Send GET request or may be any request with any ID session.

What is the expected result?

That the query will not be inserted into the database table "session".

What do you get instead?

In DB will be inserted the query in table "session".

Additional info

Q	A
Yii version	2.0.15.1
PHP version	7.3
Operating system	Win 8.1

[samdark]

Why wouldn't it be inserted if the session is actually started?

[Yuriy-Svetlov]

@samdark

Why wouldn't it be inserted if the session is actually started?

But this session do`not exist in DB. This session must not opened. But it starts.

[samdark]

How do you pass session ID via GET?

[Yuriy-Svetlov]

@samdark

// Iteration 1

1. No need login on a site. (clear all sessions for site)
2. Open developer console in the browser.
3. Create session cookie: set any value (as example: ln06etc8od44p7ilv07ek6shef3dvjt477) for session cookie name "PHPSESSID".
4. Refresh the browser page.
5. Look in database. This session will be written in the database.

// Iteration 2, 3, 4, 5 ....
Change value of session cookie name "PHPSESSID", and refresh the browser page.

All sessions will be recorded in the database.

[samdark]

The behavior you are observing is normal and controlled by session.use_strict_mode php.ini setting. It is 0 by default, when changed to 1, PHP doesn't create a session with a user-specified ID.

[samdark]

I've added a mention of the setting to the guide.

[Yuriy-Svetlov]

@samdark
Thanks you very much!