Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:122980
Precedence: bulk
MIME-Version: 1.0
References: <CAGBsUrera8cVE5nW1H6bCSok+gOjpHCyqutaCewoXEtYju-8yA@mail.gmail.com>
 <gvsLDSENsS87LGXzp2ZHU3Zan2V-OVjzFJbT2yHDVj2N4xsv29gIyfTRMrloA25H4YoNauhS9DL9_4YM6fBthqSnC7AGnkoZk2X3CNptGow=@gpb.moe>
 <CAGBsUrecUD89R_AViHAGFNYLCewj7w=3Vb0VKbqbUzsRSZ9phA@mail.gmail.com>
 <82F88666-F8B4-4E86-AD7D-F4CA75EBF6E0@dafert.at> <CAGBsUreKJb1dp+PuByj6XnYzOD3Xzb7Z64zF7q+7JPa77uYpkw@mail.gmail.com>
 <CAGBsUrf4nQ8vs3-mFhxsL3wLzuf1TfLm18t+TFFkxM3itNbXMQ@mail.gmail.com> <1D89DC42-4E1E-4998-A109-1806D9C03612@gmail.com>
In-Reply-To: <1D89DC42-4E1E-4998-A109-1806D9C03612@gmail.com>
Date: Fri, 5 Apr 2024 21:05:12 +0200
Message-ID: <CAGBsUrdQSTXi6rKFy+++eFaq2Z-dYZxarHE3E4b1qRR0UusH=A@mail.gmail.com>
Subject: Re: [PHP-DEV] [RFC] [Discussion] Deprecate GET/POST sessions
To: Claude Pache <claude.pache@gmail.com>
Cc: internals@lists.php.net
Content-Type: text/plain; charset="UTF-8"
From: tekiela246@gmail.com (Kamil Tekiela)

>1. In session_start(), it is possible to override ini settings like that:
>
>```php
>session_start([ 'use_cookies' => '1', 'use_only_cookies' => '1', 'referer_check' => '' ]);
>```
>
>The relevant options should also be deprecated in that context.

Yes, they are. You can see that in my draft PR
https://github.com/php/php-src/pull/13578

> 2. A clarification: Suppose that I have  `session.use_only_cookie = 1` in my ini file (no deprecation warning), and I call `ini_set("session.use_only_cookie", "1")` in my code (no-op). Will the `ini_set(...)` invocation trigger a deprecation warning?

As mentioned in the RFC, only changing the option to the deprecated
value triggers the deprecation. You can verify this using my draft PR.
Similarly, if your INI file triggers a deprecations due to for example
session.use_only_cookie=0 and then in your PHP file you change it
using ini_set("session.use_only_cookie", "1") or using the argument to
session_start(), it will only trigger the deprecation during startup
and not during runtime of the script.