ext/session: secure session configuration defaults (RFC)#21938
Conversation
jorgsowa
force-pushed
the
session-security-defaults-rfc
branch
from
f1e14f9 to
8e76687
Compare
Girgias
left a comment
Girgias
left a comment
There was a problem hiding this comment.
Merge conflict but LGTM, thank you!
Implements the "Secure Session Configuration Defaults" RFC by changing three INI defaults to provide secure session behavior out of the box: - session.use_strict_mode: 0 -> 1 (mitigates session fixation) - session.cookie_httponly: 0 -> 1 (mitigates XSS access to session cookie) - session.cookie_samesite: "" -> "Lax" (mitigates CSRF) RFC: https://wiki.php.net/rfc/session_security_defaults
jorgsowa
force-pushed
the
session-security-defaults-rfc
branch
from
02424cb to
23ebec1
Compare
|
All new defaults have been accepted in RFC: https://wiki.php.net/rfc/session_security_defaults PR is ready to be merged after all tests pass. |
| ; enabling it is encouraged. | ||
| ; vulnerability. | ||
| ; https://wiki.php.net/rfc/strict_sessions | ||
| session.use_strict_mode = 0 |
There was a problem hiding this comment.
This entry should probably also be commented out, since it matches the default. Same for the others. Might make sense to do this change as a follow-up.
There was a problem hiding this comment.
That's a good point. Thanks. I will do it today.
There was a problem hiding this comment.
I reconsidered it, and I don't think it's a good idea. Changing configuration defaults doesn't introduce breaking changes because those values have been explicitly set in php.ini. Otherwise, updating the PHP version would change the session configuration values.
So if we decide again that the defaults must be changed, the changes will only affect new PHP installations, not existing installations after an update.
3 participants
Implements the "Secure Session Configuration Defaults" RFC by changing three INI defaults to provide secure session behavior out of the box:
session.use_strict_mode: 0 -> 1session.cookie_httponly: 0 -> 1session.cookie_samesite: "" -> "Lax"RFC: https://wiki.php.net/rfc/session_security_defaults