[VOTE] Secure Session Configuration Defaults

Hello internals,
I'm opening up the vote on this RFC.

Wiki page: https://wiki.php.net/rfc/session_security_defaults

There are three votes to cast, and the voting will end on
2026-05-18 00:00:00 UTC.

Kind regards,
Jorg

Under the References section of the RFC, would you mind providing a link
to the relevant mailing list discussion? I can't find the discussion,
and I'd like to see what others have said about the proposal. I would
consider this an editorial change, so it shouldn't affect the voting
timeline (i.e., you don't need to stop the vote and restart it).

According to the voting procedure rules, your voting announcement email
must also include a link to the discussion thread. Again, simply
replying here with the link should suffice.

https://github.com/php/policies/blob/main/feature-proposals.rst#voting-procedure

Cheers,
Ben

I'm opening up the vote on this RFC.

Wiki page: https://wiki.php.net/rfc/session_security_defaults

There are three votes to cast, and the voting will end on
2026-05-18 00:00:00 UTC.

Hi Jorg,
The votes must also contain an "Abstain" option.

Thank you,
Ayesh.

Hello internals,

The voting has been closed. All changes have been accepted with the
following results:

• Change session.use_strict_mode default to 1 -> 27 Yes, 0 No, 0 Abstain
• Change session.cookie_httponly default to 1 -> 26 Yes, 0 No, 1 Abstain
• Change session.cookie_samesite default to La -> 26 Yes, 0 No, 0 Abstain

Thank you very much for participation.

Kind regards,
Jorg