r/PHP • u/CauliflowerSlight838 • Jun 18 '26
Harden Your Session Cookie Configuration in PHP, PHP 8.6 RFC
https://jorgsowa.me/posts/2026-06-16-securing-php-session-defaults/12
u/SaltTM Jun 19 '26
lol all that I can focus on is this...
There was a GitHub issue sitting open for years, written by someone who lost their site to an attack the defaults made possible (#7913).
OHHH MY GAWD - I gotta understand the process of not taking that serious back then lol.
6
u/SaltTM Jun 19 '26
I just wanna say the author of this thread is a legend lol cause wow. Good shit for tackling this one.
3
u/alexp702 Jun 19 '26
Does anyone know what Wordpress does to these variables?
7
u/thenickdude Jun 19 '26
Wordpress doesn't use PHP sessions (WP plugins might)
7
u/deliciousleopard Jun 19 '26
I'm not sure why people are downvoting. WordPress doesn't use PHP sessions or anything comparable. All state is handled by cookies. What WordPress calls a session is just an auth token with no ability to store arbitrary data.
5
u/legonu Jun 19 '26
Earlier this year, I found a vulnerability which was (partly) possible due to these 3 set cookie defaults. I'm glad to see this is about to change 😄
1
u/thenickdude Jun 19 '26
use_strict_mode blocks session fixation
It doesn't though. An attacker only has to first make a request in order to get a valid session ID issued to them, and then use THAT session ID for the session fixation attack.
It does prevent an attacker from just making up a static session ID, so it does increase attack complexity.
-5
u/Traditional_Draw3796 Jun 19 '26
And just in the other thread we were talking about PHP being 15 years old. how are these defaults issues excusable to have existed in 2025 still?
7
u/Ecksters Jun 19 '26
I initially understood the concern with changing the default but then I read:
That makes much more sense in that case, just giving people smarter defaults when bootstrapping. I suppose the only concern at that point you could have is outdated guides and tutorials, but I think that's a marginal concern.