Skip to content

Commit f1e14f9

Browse files
jorgsowajorgsowa
committed
ext/session: secure session configuration defaults (PHP 8.6 RFC)
Implements the "Secure Session Configuration Defaults" RFC by changing three INI defaults to provide secure session behavior out of the box: - session.use_strict_mode: 0 -> 1 (mitigates session fixation) - session.cookie_httponly: 0 -> 1 (mitigates XSS access to session cookie) - session.cookie_samesite: "" -> "Lax" (mitigates CSRF) RFC: https://wiki.php.net/rfc/session_security_defaults
1 parent c130d42 commit f1e14f9

5 files changed

Lines changed: 32 additions & 13 deletions

File tree

‎NEWS‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,9 @@ PHP NEWS
136136
- Session:
137137
. Fixed bug 71162 (updateTimestamp never called when session data is empty).
138138
(Girgias)
139+
. Changed defaults of session.use_strict_mode (now 1), session.cookie_httponly
140+
(now 1) and session.cookie_samesite (now "Lax") to provide secure session
141+
behavior out of the box. (RFC: Secure Session Configuration Defaults)
139142

140143
- Soap:
141144
. Soap::__setCookie() when cookie name is a digit is now not stored and

‎UPGRADING‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,24 @@ PHP 8.6 UPGRADE NOTES
7575
comparison. Custom session handlers that rely on write() being called
7676
with empty data (e.g. to destroy the session) should implement the same
7777
logic in their updateTimestamp() method.
78+
. The defaults of three session INI settings have changed to provide secure
79+
behavior out of the box:
80+
- session.use_strict_mode is now 1 (was 0). Strict mode rejects
81+
uninitialized session IDs, mitigating session fixation. Custom session
82+
handlers that previously relied on accepting externally supplied IDs
83+
without a corresponding storage entry must either implement
84+
validateId() / create_sid() or explicitly set this to 0.
85+
- session.cookie_httponly is now 1 (was 0). Session cookies are no
86+
longer accessible to JavaScript via document.cookie. Applications
87+
that read the session cookie from JavaScript must explicitly set
88+
this to 0.
89+
- session.cookie_samesite is now "Lax" (was unset). Session cookies
90+
are no longer sent on cross-site requests other than top-level
91+
navigations using safe HTTP methods. Applications that depend on
92+
session cookies being sent on cross-site POST submissions must
93+
explicitly set this to "None" (and also set session.cookie_secure
94+
to 1).
95+
RFC: https://wiki.php.net/rfc/session_security_defaults
7896

7997
- SPL:
8098
. SplFileObject::next() now advances the stream when no prior current()

‎ext/session/session.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -923,11 +923,11 @@ PHP_INI_BEGIN()
923923
STD_PHP_INI_ENTRY("session.cookie_domain", "", PHP_INI_ALL, OnUpdateSessionStr, cookie_domain, php_ps_globals, ps_globals)
924924
STD_PHP_INI_BOOLEAN("session.cookie_secure", "0", PHP_INI_ALL, OnUpdateSessionBool, cookie_secure, php_ps_globals, ps_globals)
925925
STD_PHP_INI_BOOLEAN("session.cookie_partitioned", "0", PHP_INI_ALL, OnUpdateSessionBool, cookie_partitioned, php_ps_globals, ps_globals)
926-
STD_PHP_INI_BOOLEAN("session.cookie_httponly", "0", PHP_INI_ALL, OnUpdateSessionBool, cookie_httponly, php_ps_globals, ps_globals)
927-
STD_PHP_INI_ENTRY("session.cookie_samesite", "", PHP_INI_ALL, OnUpdateSessionSameSite, cookie_samesite, php_ps_globals, ps_globals)
926+
STD_PHP_INI_BOOLEAN("session.cookie_httponly", "1", PHP_INI_ALL, OnUpdateSessionBool, cookie_httponly, php_ps_globals, ps_globals)
927+
STD_PHP_INI_ENTRY("session.cookie_samesite", "Lax", PHP_INI_ALL, OnUpdateSessionSameSite, cookie_samesite, php_ps_globals, ps_globals)
928928
STD_PHP_INI_BOOLEAN("session.use_cookies", "1", PHP_INI_ALL, OnUpdateSessionBool, use_cookies, php_ps_globals, ps_globals)
929929
STD_PHP_INI_BOOLEAN("session.use_only_cookies", "1", PHP_INI_ALL, OnUpdateUseOnlyCookies, use_only_cookies, php_ps_globals, ps_globals)
930-
STD_PHP_INI_BOOLEAN("session.use_strict_mode", "0", PHP_INI_ALL, OnUpdateSessionBool, use_strict_mode, php_ps_globals, ps_globals)
930+
STD_PHP_INI_BOOLEAN("session.use_strict_mode", "1", PHP_INI_ALL, OnUpdateSessionBool, use_strict_mode, php_ps_globals, ps_globals)
931931
STD_PHP_INI_ENTRY("session.referer_check", "", PHP_INI_ALL, OnUpdateRefererCheck, extern_referer_chk, php_ps_globals, ps_globals)
932932
STD_PHP_INI_ENTRY("session.cache_limiter", "nocache", PHP_INI_ALL, OnUpdateSessionStr, cache_limiter, php_ps_globals, ps_globals)
933933
STD_PHP_INI_ENTRY("session.cache_expire", "180", PHP_INI_ALL, OnUpdateSessionLong, cache_expire, php_ps_globals, ps_globals)

‎php.ini-development‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1305,10 +1305,9 @@ session.save_handler = files
13051305
; Strict session mode does not accept an uninitialized session ID, and
13061306
; regenerates the session ID if the browser sends an uninitialized session ID.
13071307
; Strict mode protects applications from session fixation via a session adoption
1308-
; vulnerability. It is disabled by default for maximum compatibility, but
1309-
; enabling it is encouraged.
1308+
; vulnerability.
13101309
; https://wiki.php.net/rfc/strict_sessions
1311-
session.use_strict_mode = 0
1310+
session.use_strict_mode = 1
13121311

13131312
; Whether to use cookies.
13141313
; https://php.net/session.use-cookies
@@ -1350,13 +1349,13 @@ session.cookie_domain =
13501349
; Whether or not to add the httpOnly flag to the cookie, which makes it
13511350
; inaccessible to browser scripting languages such as JavaScript.
13521351
; https://php.net/session.cookie-httponly
1353-
session.cookie_httponly =
1352+
session.cookie_httponly = 1
13541353

13551354
; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF)
13561355
; Current valid values are "Strict", "Lax" or "None". When using "None",
13571356
; make sure to include the quotes, as `none` is interpreted like `false` in ini files.
13581357
; https://tools.ietf.org/html/draft-west-first-party-cookies-07
1359-
session.cookie_samesite =
1358+
session.cookie_samesite = "Lax"
13601359

13611360
; Handler used to serialize data. php is the standard serializer of PHP.
13621361
; https://php.net/session.serialize-handler

‎php.ini-production‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1307,10 +1307,9 @@ session.save_handler = files
13071307
; Strict session mode does not accept an uninitialized session ID, and
13081308
; regenerates the session ID if the browser sends an uninitialized session ID.
13091309
; Strict mode protects applications from session fixation via a session adoption
1310-
; vulnerability. It is disabled by default for maximum compatibility, but
1311-
; enabling it is encouraged.
1310+
; vulnerability.
13121311
; https://wiki.php.net/rfc/strict_sessions
1313-
session.use_strict_mode = 0
1312+
session.use_strict_mode = 1
13141313

13151314
; Whether to use cookies.
13161315
; https://php.net/session.use-cookies
@@ -1352,13 +1351,13 @@ session.cookie_domain =
13521351
; Whether or not to add the httpOnly flag to the cookie, which makes it
13531352
; inaccessible to browser scripting languages such as JavaScript.
13541353
; https://php.net/session.cookie-httponly
1355-
session.cookie_httponly =
1354+
session.cookie_httponly = 1
13561355

13571356
; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF)
13581357
; Current valid values are "Strict", "Lax" or "None". When using "None",
13591358
; make sure to include the quotes, as `none` is interpreted like `false` in ini files.
13601359
; https://tools.ietf.org/html/draft-west-first-party-cookies-07
1361-
session.cookie_samesite =
1360+
session.cookie_samesite = "Lax"
13621361

13631362
; Handler used to serialize data. php is the standard serializer of PHP.
13641363
; https://php.net/session.serialize-handler

0 commit comments

Comments
 (0)