Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:110424
MIME-Version: 1.0
References: <4096e114-49ba-d553-f4a9-ce65cbda14f5@allenjb.me.uk> <CA73E127-47A1-41E5-81D5-8E170DB63239@gmail.com>
In-Reply-To: <CA73E127-47A1-41E5-81D5-8E170DB63239@gmail.com>
Date: Mon, 8 Jun 2020 10:36:39 -0400
Message-ID: <CAF0C5SLo_6j1pSixE-0ZsGAK3oCkkbx553sDGOcQMPWbDq2zbw@mail.gmail.com>
To: Claude Pache <claude.pache@gmail.com>
Cc: AllenJB <php.lists@allenjb.me.uk>, PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="0000000000008ce75905a7938a9b"
Subject: Re: [PHP-DEV] Session default settings (use_strict_mode)
From: kohler@seas.harvard.edu (Eddie Kohler)

--0000000000008ce75905a7938a9b
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Enabling same-site cookies by default is a little risky now, because
current browsers don't always set them properly.

https://bugs.chromium.org/p/chromium/issues/detail?id=3D961617


On Sun, Jun 7, 2020 at 6:42 PM Claude Pache <claude.pache@gmail.com> wrote:

>
>
> > Le 7 juin 2020 =C3=A0 22:15, AllenJB <php.lists@allenjb.me.uk> a =C3=A9=
crit :
> >
> > Are there any other session (security) related settings that should be
> tightened by default? (cookie_samesite?)
>
>
> Yes, of course:
>
> * session.cookie_httponly should be "1" by default.
> * session.cookie_samesite should be "Lax" by default.
> * Ideally, session.cookie_secure should be enabled by default on https;
> sadly, the setting does not allow to have different values for secure and
> insecure connections.
>
> =E2=80=94Claude

--0000000000008ce75905a7938a9b--