/    Sign up×
Community /Pin to ProfileBookmark

Session id collision with custom session storage

Currently i have a custom session storage setup using session_set_save_handler and mysql. The question i have pertains to the probability of a session hash collision. The system currently stores the session hash in a mysql table that stores the session data, session hash and expiration time. But i am extending the time the session lasts to a week longer than its current time, this will obviously cause an increase in the amount of id’s stored, and thus an increase in the possibility of a hash collision.
I’ve read that php checks if a session id already exists before generating it… for its default session handler that is, but does it still check when using a custom handler? If not its a trivial matter to program in my own check, i’d just like to know before adding in more overhead.

p.s. If it matters i have the session garbage collector time set to an hour with a probability of 1 with a divisor of 1 so that it will always run every hour.

to post a comment
PHP

3 Comments(s)

Copy linkTweet thisAlerts:
@ilbonparaurtiMay 18.2010 — If done correctly, there should be a VERY low probability of a collision - even for a site that receives thousands of hits a month.

but does it still check when using a custom handler?[/QUOTE]

This also depends on the custom handler.
Copy linkTweet thisAlerts:
@NogDogMay 18.2010 — I don't think (but am not 100% sure) that there would be any difference in the session ID allocation regardless of whether you use the default session handler or your own. If using PHP 5, you could reduce any such (very small) likelihood via the [url=http://fr.php.net/manual/en/session.configuration.php#ini.session.hash-function]session.hash_function[/url] config item and setting it to "1" so that it uses sha-1 instead of md5.
Copy linkTweet thisAlerts:
@Jarrod1937authorMay 18.2010 — Excellent, thanks for the replies. It looks like i probably won't need to worry about any collisions then. If they do become an issue it will be easy enough to program the handler to check, so no issue there.

Thanks for the help.
×

Success!

Help @Jarrod1937 spread the word by sharing this article on Twitter...

Tweet This
Sign in
Forgot password?
Sign in with TwitchSign in with GithubCreate Account
about: ({
version: 0.1.9 BETA 5.7,
whats_new: community page,
up_next: more Davinci•003 tasks,
coming_soon: events calendar,
social: @webDeveloperHQ
});

legal: ({
terms: of use,
privacy: policy
});
changelog: (
version: 0.1.9,
notes: added community page

version: 0.1.8,
notes: added Davinci•003

version: 0.1.7,
notes: upvote answers to bounties

version: 0.1.6,
notes: article editor refresh
)...
recent_tips: (
tipper: @AriseFacilitySolutions09,
tipped: article
amount: 1000 SATS,

tipper: @Yussuf4331,
tipped: article
amount: 1000 SATS,

tipper: @darkwebsites540,
tipped: article
amount: 10 SATS,
)...