# [RFC] Secure Session Configuration Defaults

- Thread: https://externals.io/message/130608
- Original archive: https://news-web.php.net/php.internals/130608
- Started by Jorg Sowa on 2026-04-11T18:23:28+00:00
- Messages: 3
- RFC: Secure Session Configuration Defaults (Implemented (PHP 8.6)) — https://externals.io/rfc/session_security_defaults.md
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · RFCs at https://externals.io/rfc.md · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #130608 — Jorg Sowa — 2026-04-11T18:23:28+00:00

URL: https://externals.io/message/130608#130608

Hello internals,
I would like to propose RFC about securing the session configuration
defaults. It's been already discussed many times in the github issues, so I
would like to finally create and RFC about it.

Link:
https://wiki.php.net/rfc/session_security_defaults

Kind regards,
Jorg

---

## #130623 — Gina P. Banyard — 2026-04-13T11:02:21+00:00

URL: https://externals.io/message/130608#130623 · In reply to: #130608

> Hello internals,
> I would like to propose RFC about securing the session configuration defaults. It's been already discussed many times in the github issues, so I would like to finally create and RFC about it.
> Link:
> https://wiki.php.net/rfc/session_security_defaults
>
> Kind regards,
> Jorg

Hello,

Thank you for tackling this, I was planning on doing a similar RFC to modernize ext/session.
The main change I would like to see is to actually *deprecate* the session.use_strict_mode INI setting and to always force it to 1.

This would require userland SessionHandlers to always implement the [create_sid](https://www.php.net/manual/en/sessionidinterface.create-sid.php) and [validateId](https://www.php.net/manual/en/sessionupdatetimestamphandlerinterface.validateid.php) methods.
Now for some reason these are on 2 different interfaces which I don't understand.
Implementation wise, I wouldn't force classes to implement the different interfaces, but just emit a deprecation that these methods will be required and move the methods onto the generic SessionHandlerInterface in PHP 9.

>

Happy to work on this implementation of this if needed.

Best regards,
Gina P. Banyard

---

## #130689 — Jorg Sowa — 2026-04-24T07:40:38+00:00

URL: https://externals.io/message/130608#130689 · In reply to: #130623

Thanks Gina for input. I see it as an improvement as well and would be
happy to help with it. However, I like to keep things separated in this RFC.

If no new comments will arrive I would like to move to voting phase next
week.

Kind regards,
Jorg