Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:110411
To: PHP internals <internals@lists.php.net>
Message-ID: <4096e114-49ba-d553-f4a9-ce65cbda14f5@allenjb.me.uk>
Date: Sun, 7 Jun 2020 21:15:48 +0100
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101
 Thunderbird/68.9.0
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Content-Language: en-GB
Subject: Session default settings (use_strict_mode)
From: php.lists@allenjb.me.uk (AllenJB)

Hi all,

While writing an answer to someone regarding session security, I noticed 
that session.use_strict_mode is disabled by default, despite it being 
"mandatory for session security" (according to the description in the 
manual - 
https://www.php.net/manual/en/session.configuration.php#ini.session.use-strict-mode 
).

I tried a search of the mailing list and found an RFC declined 4 years 
ago, albeit with very few votes:
https://externals.io/message/94484

Should use_strict_mode be enabled by default?

My best guess is the previous RFC was declined due to the issues with 
lost sessions enumerated in the above linked thread. Do these still 
exist (have their been changes since this RFC)? Could the feature be 
improved to mitigate or remove these?

If the setting default is not changed, should the manual description of 
this setting be improved to describe why it's not enabled by default?

Are there any other session (security) related settings that should be 
tightened by default? (cookie_samesite?)


AllenJB