As the title asks,

正如书名所说，

What are the pros and cons of high php session.sid_bits_per_character and session.sid_length?
The obvious pros are that the higher bits and length means even harder to brute force or overlaps, but is there much or any cons aside from the vague compatibility problem?

高php会话数.sid_bitsper_Character和会话数.sid_long的优缺点是什么？显而易见的好处是，更高的比特和长度意味着更难暴力或重叠，但除了模糊的兼容性问题，还有很多或任何不利之处吗？

I ask this as that is as much information the manual provides.
https://www.php.net/manual/en/session.configuration.php#ini.session.hash-function

我问这个是因为这是手册提供的所有信息。Https://www.php.net/manual/en/session.configuration.php#ini.session.hash-function

I can imagine possible cons, but these are at most dumb guesses.

我可以想象可能的骗局，但这些充其量都是愚蠢的猜测。

• longer length means bigger cookies and longer processing, also longer for RDBS id matching (with the unique, key column constraints? But as a key column, shouldn't matter right?)


• longer to generate? Maybe but probably by an impactable amount??


• Uses more resources for the longer length, but what about bit size does that use more resources? And is it even noticably more for the length and/or bit increase.

Is there any reason NOT to change these 2 settings to the following in the php.ini file?

有什么理由不在php.ini文件中将这两个设置更改为以下设置吗？

sid_bits_per_character = 6
sid_length = 256

edit: added the possible con of using more resources

编辑：添加了使用更多资源的可能缺点

sids are ephemeral rather than permanent. So the number of them you need to store is proportional to the number of active users you have, not total users. That's good when you use an RDBMS for session storage: in large tables random primary keys are not very efficient but session tables -- with sids for primary keys -- aren't that large.

小岛屿发展中国家是短暂的，而不是永久的。因此，您需要存储的用户数量与您拥有的活动用户数量成正比，而不是与总用户数量成正比。当您使用RDBMS进行会话存储时，这很好：在大型表中，随机主键效率不是很高，但是会话表--主键为SID--并不是那么大。

Ephemerality also means you can change sid format in the future, with the only operational cost being the cancellation of all active sessions when you switch. You can get away with that once in a great while if you announce scheduled downtime.

短暂性还意味着您可以在未来更改sid格式，唯一的运营成本是在您切换时取消所有活动会话。如果您宣布计划的停机时间，您可以在很长一段时间内幸免于难。

Longer sids are more secure. Adding six bits to a random sid makes it 64 times harder to guess. A 192-bit sid (32 bytes at six bits per byte) is just fine, and won't raise flags with people like payment-card industry infosec auditors. Longer is OK too, but 256 bytes is overkill. The extra cost, CPU, storage, and bandwidth, of a few-bytes-longer cookie value is too small to measure. You can save thousands of times more server and bandwidth resources by doing things like compressing images more efficiently. Much bigger payoff than shaving bytes off sids.

更长的SID更安全。将六位加到一个随机的sid上会使猜测的难度增加64倍。192位的sid(32字节，每字节6位)就足够了，而且不会引起支付卡行业信息安全审计人员的注意。更长也没问题，但256个字节就太过分了。更长几个字节的Cookie值的额外成本(CPU、存储和带宽)太小，无法衡量。通过更高效地压缩图像等操作，您可以节省数千倍的服务器和带宽资源。比削减小岛屿发展中国家的字节数多得多的回报。

Avoid using MD5 or SHA-1 hash algorithms. Use SHA-224 or something at least as secure. Auditors don't like the less secure ones. Using a better one saves you the hassle of explaining to the auditor how the worse ones are still ok for short-lived ephemeral values.

避免使用MD5或SHA-1散列算法。使用SHA-224或至少同样安全的东西。审计师不喜欢不太安全的公司。使用较好的方法可以省去向审计师解释为什么较差的方法仍然适用于短期价值的麻烦。

The session subsystem in php lets you switch from file-system session storage to RDBMS or cache-server storage when your site traffic grows enough that you need it : when you need multiple load-balanced web server machines. You don't have to overengineer that part of your app from day one. Just do your session-variable development correctly and you're ready for the future.

Php中的会话子系统允许您在站点流量增长到需要时从文件系统会话存储切换到RDBMS或缓存服务器存储：当您需要多台负载平衡的Web服务器计算机时。你不必从第一天起就过度设计你的应用程序的这一部分。只要正确地进行会话变量开发，就可以为未来做好准备。