Session Cookies Default To Secure Settings¶
The built-in defaults of three session INI settings changed to provide secure behavior out of the box: session.use_strict_mode is now 1 (was 0), session.cookie_httponly is now 1 (was 0), and session.cookie_samesite is now Lax (was unset). Applications that relied on the old permissive defaults, such as accepting externally supplied session IDs, reading the session cookie from JavaScript, or sending it on cross-site POST requests, must now set these directives explicitly.
PHP code¶
<?php
$out = shell_exec(PHP_BINARY . ' -n -r ' . escapeshellarg('var_dump(ini_get("session.use_strict_mode"), ini_get("session.cookie_httponly"), ini_get("session.cookie_samesite"));'));
echo $out;
?>
Before¶
string(1) 0
string(1) 0
string(0)
After¶
string(1) 1
string(1) 1
string(3) Lax
PHP version change¶
This behavior changed in 8.6
