Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:122636
Date: Thu, 14 Mar 2024 11:24:09 +0100
To: internals@lists.php.net
Subject: Re: [PHP-DEV] [RFC] [Discussion] Deprecate GET/POST sessions
User-Agent: K-9 Mail for Android
In-Reply-To: <CAGBsUrecUD89R_AViHAGFNYLCewj7w=3Vb0VKbqbUzsRSZ9phA@mail.gmail.com>
References: <CAGBsUrera8cVE5nW1H6bCSok+gOjpHCyqutaCewoXEtYju-8yA@mail.gmail.com> <gvsLDSENsS87LGXzp2ZHU3Zan2V-OVjzFJbT2yHDVj2N4xsv29gIyfTRMrloA25H4YoNauhS9DL9_4YM6fBthqSnC7AGnkoZk2X3CNptGow=@gpb.moe> <CAGBsUrecUD89R_AViHAGFNYLCewj7w=3Vb0VKbqbUzsRSZ9phA@mail.gmail.com>
Message-ID: <82F88666-F8B4-4E86-AD7D-F4CA75EBF6E0@dafert.at>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain;
 charset=utf-8
Content-Transfer-Encoding: quoted-printable
From: mel@dafert.at (Mel Dafert)

>From: Anton Smirnov <arokettu@outlook=2Ecom>
>Date: Sun, 3 Mar 2024 at 19:56
>
>Greetings!
>
>As I know some session-related middlewares force custom-only session_id
>handling by setting
>
>   use_cookies =3D Off
>   use_only_cookies =3D On
>
>and then using session_id(=2E=2E=2E) directly
>
>Example:
>https://github=2Ecom/middlewares/php-session/blob/master/src/PhpSession=
=2Ephp#L137
>
>I think if you're making this hack impossible, you should provide an
>alternative non-hackish way to do this=2E
>
>Maybe just keep use_cookies =3D Off
>
>A wild idea:
>
>1) Add a temporary config
>
>   # by default; current behavior;
>   # throws a deprecation right from the introduction
>   cookies=2Euse_post_get =3D On
>   # do not set the session from POST and GET
>   cookies=2Euse_post_get =3D Off
>
>Remove it in 9 with the rest
>
>2) keep use_cookies in PHP 9 with the updated meaning
>
>I don't think it's a good solution but maybe it can spark a better one
>
>Best,
>Anton

I think the better option is to make this explicit and add a config along =
the lines of `automatic_session_detection` (name to be bikeshed) defaulting=
 to `On`, and in your use-case setting it to `Off` explicitly=2E

Regards,
Mel