Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:125541
Precedence: bulk
MIME-Version: 1.0
References: <64a80dtdj.EU2uYf@akayo.eu> <EF9DB536-1DEA-430C-AC3B-710EF0C6A6C9@gmail.com>
In-Reply-To: <EF9DB536-1DEA-430C-AC3B-710EF0C6A6C9@gmail.com>
Date: Fri, 13 Sep 2024 21:54:37 +0200
Message-ID: <CAMkukMz=4b9XihKFREs87HJtiBFbvN0yFZDirLPMwX0J1bM04A@mail.gmail.com>
Subject: Re: [PHP-DEV] [GitHub #7913] Vulnerability due to insecure default
 values for session.cookie_secure and session.cookie_httponly
To: Claude Pache <claude.pache@gmail.com>
Cc: etkaar+0cvptjjwq0@akayo.eu, internals@lists.php.net
Content-Type: multipart/alternative; boundary="000000000000651c3506220598b1"
From: hello@faizanakram.me (Faizan Akram Dar)

--000000000000651c3506220598b1
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Fri, Sep 13, 2024 at 9:51=E2=80=AFPM Claude Pache <claude.pache@gmail.co=
m> wrote:

>
> Le 13 sept. 2024 =C3=A0 16:13, etkaar <etkaar@akayo.eu> a =C3=A9crit :
>
> Hi!
>
> I've created this issue in January 2022 but it seems it wasn't noticed ye=
t (since you probably do watch the mailing lists more than GitHub):https://=
github.com/php/php-src/issues/7913
>
> Kind Regards,
> etkaar
>
>
> Hi,
>
> * Defaulting `session.cookie_httponly` to `true` seems very reasonable.
>
> * Beware that if you set  `session.cookie_secure` to `true`, you will
> break websites that are not served across https. Moreover, the reason of
> the breakage may not be evident.
>
> * You forgot another obvious setting: `session.cookie_samesite` must be
> "Lax" by default.
>
> * We should also consider setting `session.use_strict_mode` to `true`, in
> order to mitigate session fixation attacks.
>
> =E2=80=94Claude
>
>
Hi,

Maybe, `session.cookie_secure` could use an additional value like `'auto'`
which would enable it for https and disable for http. Symfony does it too
https://symfony.com/doc/current/reference/configuration/framework.html#cook=
ie-secure


Kind regards,
Faizan

--000000000000651c3506220598b1
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">On Fri, Sep 13, 2024 at 9:51=E2=80=AFPM C=
laude Pache &lt;<a href=3D"mailto:claude.pache@gmail.com">claude.pache@gmai=
l.com</a>&gt; wrote:<br></div><div class=3D"gmail_quote"><blockquote class=
=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rg=
b(204,204,204);padding-left:1ex"><div><div><div><br><blockquote type=3D"cit=
e"><div>Le 13 sept. 2024 =C3=A0 16:13, etkaar &lt;<a href=3D"mailto:etkaar@=
akayo.eu" target=3D"_blank">etkaar@akayo.eu</a>&gt; a =C3=A9crit :</div><br=
><div><div style=3D"font-family:Arial;margin:0px;line-height:1.2rem;color:r=
gb(31,73,125);font-size:14px"><pre style=3D"color:rgb(23,56,96)">Hi!

I&#39;ve created this issue in January 2022 but it seems it wasn&#39;t noti=
ced yet (since you probably do watch the mailing lists more than GitHub):
<a href=3D"https://github.com/php/php-src/issues/7913" target=3D"_blank">ht=
tps://github.com/php/php-src/issues/7913</a>

Kind Regards,
etkaar</pre></div></div></blockquote></div><br></div><div>Hi,<div><br></div=
><div><div>* Defaulting `session.cookie_httponly` to `true` seems very reas=
onable.</div><div><br></div><div>* Beware that if you set =C2=A0`session.co=
okie_secure` to `true`, you will break websites that are not served across =
https. Moreover, the reason of the breakage may not be evident.</div><div><=
br></div><div>* You forgot another obvious setting: `session.cookie_samesit=
e` must be &quot;Lax&quot; by default.</div><div><br></div><div>* We should=
 also consider setting `session.use_strict_mode` to `true`, in order to mit=
igate session fixation attacks.</div><div><br></div><div>=E2=80=94Claude</d=
iv><div><br></div></div></div></div></blockquote><div><br></div><div>Hi,<br=
><br>Maybe, `session.cookie_secure` could use an additional value like `=
9;auto&#39;` which would enable it for https and disable for http. Symfony =
does it too=C2=A0<a href=3D"https://symfony.com/doc/current/reference/confi=
guration/framework.html#cookie-secure">https://symfony.com/doc/current/refe=
rence/configuration/framework.html#cookie-secure</a></div><div><br></div><d=
iv><br></div><div>Kind regards,<br>Faizan</div></div></div>

--000000000000651c3506220598b1--