Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:125536
Message-ID: <EF9DB536-1DEA-430C-AC3B-710EF0C6A6C9@gmail.com>
Content-Type: multipart/alternative;
	boundary="Apple-Mail=_917215C0-9A99-4C46-A672-00E4A6DB54F7"
Precedence: bulk
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3776.700.51\))
Subject: Re: [PHP-DEV] [GitHub #7913] Vulnerability due to insecure default
 values for session.cookie_secure and session.cookie_httponly
Date: Fri, 13 Sep 2024 19:49:34 +0200
In-Reply-To: <64a80dtdj.EU2uYf@akayo.eu>
Cc: internals@lists.php.net
To: etkaar+0cvptjjwq0@akayo.eu
References: <64a80dtdj.EU2uYf@akayo.eu>
From: claude.pache@gmail.com (Claude Pache)


--Apple-Mail=_917215C0-9A99-4C46-A672-00E4A6DB54F7
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8


> Le 13 sept. 2024 =C3=A0 16:13, etkaar <etkaar@akayo.eu> a =C3=A9crit :
>=20
> Hi!
>=20
> I've created this issue in January 2022 but it seems it wasn't noticed =
yet (since you probably do watch the mailing lists more than GitHub):
> https://github.com/php/php-src/issues/7913
>=20
> Kind Regards,
> etkaar

Hi,

* Defaulting `session.cookie_httponly` to `true` seems very reasonable.

* Beware that if you set  `session.cookie_secure` to `true`, you will =
break websites that are not served across https. Moreover, the reason of =
the breakage may not be evident.

* You forgot another obvious setting: `session.cookie_samesite` must be =
"Lax" by default.

* We should also consider setting `session.use_strict_mode` to `true`, =
in order to mitigate session fixation attacks.

=E2=80=94Claude


--Apple-Mail=_917215C0-9A99-4C46-A672-00E4A6DB54F7
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
	charset=utf-8

<html><head><meta http-equiv=3D"content-type" content=3D"text/html; =
charset=3Dutf-8"></head><body style=3D"overflow-wrap: break-word; =
-webkit-nbsp-mode: space; line-break: =
after-white-space;"><div><div><br><blockquote type=3D"cite"><div>Le 13 =
sept. 2024 =C3=A0 16:13, etkaar &lt;etkaar@akayo.eu&gt; a =C3=A9crit =
:</div><br class=3D"Apple-interchange-newline"><div><div =
class=3D"Singleton" style=3D"font-family: Arial; margin: 0px; =
line-height: 1.2rem; color: rgb(31, 73, 125); font-size: 14px;"><pre =
style=3D"text-wrap: wrap; color: rgb(23, 56, 96);">Hi!

I've created this issue in January 2022 but it seems it wasn't noticed =
yet (since you probably do watch the mailing lists more than GitHub):
<a =
href=3D"https://github.com/php/php-src/issues/7913">https://github.com/php=
/php-src/issues/7913</a>

Kind Regards,
=
etkaar</pre></div></div></blockquote></div><br></div><div>Hi,<div><br></di=
v><div><div>* Defaulting `session.cookie_httponly` to `true` seems very =
reasonable.</div><div><br></div><div>* Beware that if you set =
&nbsp;`session.cookie_secure` to `true`, you will break websites that =
are not served across https. Moreover, the reason of the breakage may =
not be evident.</div><div><br></div><div>* You forgot another obvious =
setting: `session.cookie_samesite` must be "Lax" by =
default.</div><div><br></div><div>* We should also consider setting =
`session.use_strict_mode` to `true`, in order to mitigate session =
fixation =
attacks.</div><div><br></div><div>=E2=80=94Claude</div><div><br></div></di=
v></div></body></html>=

--Apple-Mail=_917215C0-9A99-4C46-A672-00E4A6DB54F7--