# RFC: Enable session.use_strict_mode by default

- Status: Declined
- Authors: Yasuo Ohgaki yohgaki@ohgaki.net
- Date: 2016-07-05
- Version: 1.0
- Original: https://wiki.php.net/rfc/session-use-strict-mode
- Page: https://externals.io/rfc/session-use-strict-mode
- More for agents: search with https://externals.io/search.md?q={query} · RFCs at https://externals.io/rfc.md · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

## Votes

### Enable session.use_strict_mode by default (closed)

Yes: 4 · No: 4

Voters: derick (No), guilhermeblanco (Yes), kguest (No), kinncj (No), mcmic (Yes), stas (Yes), yohgaki (Yes), zimt (No)

## Discussions on the mailing list

- [\[RFC\]\[DISCUSSION\] Enable session.use_strict_mode by default](https://externals.io/message/94377.md) — started on 2016-07-04, 1 messages
- [\[RFC\]\[VOTE\] Enable session.use_strict_mode by default](https://externals.io/message/94484.md) — started on 2016-07-12, 8 messages
- [Session Security manual page is updated](https://externals.io/message/95967.md) — started on 2016-09-13, 1 messages

---

## Introduction

Due to HTTP cookie implementation, it is easy to create unchangeable/undeletable cookies via JavaScript injections. Single JavaScript injection vulnerability or cookie storage modification via physical access to the client allows attackers to steal user session forever without session.use\_strict\_mode=1.

NOTE: When multiple cookies are valid for a request, browser sends a highest precedence cookie. Cookie sent by browsers differs browser by browser because there is no cookie precedence standard. Attacker can exploit this browser behavior to set unchangeable cookies by using httponly, secure, domain and path cookie attributes. Security impact differs according to web site setup, used browser and session handling code.

## Proposal

Enable session.use\_strict\_mode INI setting by default.

- session.use\_strict\_mode=1

in hard coded, php.ini-\*.

Document deprecation of obsolete session save handler API that does not support session.use\_strict\_mode.

- PS\_FUNCS

## Performance Impact

session.use\_strict\_mode=1 requires

- Session ID existence validation. (Additional query to session data storage may be needed depending on save handler implementation.)
- New session ID regeneration required when nonexistent session ID is passed.

Files save handler will not be affected much, but external session data storage may have noticeable impact.

## Backward Incompatible Changes

session.use\_strict\_mode=1 can result in lost sessions without changes like

- [https://wiki.php.net/rfc/precise\_session\_management](https://externals.io/rfc/precise_session_management) (Declined)

However, lost sessions are far better than stolen sessions.

When attackers set unchangeable session ID cookie for a user, the user will not be able to get valid session ID. i.e. Cannot login via attacker supplied unchangeable session ID, etc.

3rd party session save handlers must implement session ID validation handler for session.use\_strict\_mode=1 to work actually. i.e. 3rd party session save handlers must use PS\_FUNCS\_SID or PS\_FUNCS\_UPDATE\_TIMESTAMP. **PS\_FUNCS\_UPDATE\_TIMESTAMP is strongly recommended.**

## Proposed PHP Version(s)

PHP 7.1.0

## RFC Impact

### To SAPIs

None

### To Existing Extensions

Session

### To Opcache

None

### New Constants

None

### php.ini Defaults

session.use\_strict\_mode=1 for all

- hardcoded default values
- php.ini-development values
- php.ini-production values

## Open Issues

## Unaffected PHP Functionality

3rd party and user defined session save handlers implementation is not affected.

3rf party session handlers must implement session ID validation handler for session.use\_strict\_mode=1 to work actually. i.e. PS\_FUNCS\_SID or PS\_FUNCS\_UPDATE\_TIMESTAMP must be used. PS\_FUNCS\_UPDATE\_TIMESTAMP is strongly recommended.

## Future Scope

- Session ID should be managed by TTL timestamp in order to manage session ID correctly and precisely.
- Remove session.use\_strict\_mode setting and enable it always.
- Remove session\_regenerate\_id()'s immediate session ID data removal option. i.e. Manage session data lifetime by TTL.
- Remove additional session data storage access by extending session save handler API.

## Vote

This project requires 2/3 majority

**Vote: Enable session.use\_strict\_mode by default** — Yes: 4 · No: 4 (closed)

Vote starts 2016/7/12, ends 2016/07/19 23:59:59 UTC.

## Patches and Tests

Not provided as this change is trivial INI default change. Tests scripts are modified to work regardless of session.use\_strict\_mode=0/1 already.

## Implementation

After the project is implemented, this section should contain

1. the version(s) it was merged to
2. a link to the git commit(s)
3. a link to the PHP manual entry for the feature

## References

- [https://wiki.php.net/rfc/precise\_session\_management](https://externals.io/rfc/precise_session_management)

## Rejected Features

Keep this updated with features that were discussed on the mail lists.