[PHP-DEV] [GitHub #7913] Vulnerability due to insecure default values for session.cookie_secure and session.cookie_httponly

Mailing Lists php.internals
1 
Hi!

I've created this issue in January 2022 but it seems it wasn't noticed yet (since you probably do watch the mailing lists more than GitHub):
https://github.com/php/php-src/issues/7913

Kind Regards,
etkaar
2

Le 13 sept. 2024 à 16:13, etkaar etkaar@akayo.eu a écrit :

Hi!

I've created this issue in January 2022 but it seems it wasn't noticed yet (since you probably do watch the mailing lists more than GitHub):
[https://github.com/php/php-src/issues/7913](https://github.com/php/php-src/issues/7913)

Kind Regards,
etkaar

Hi,

  • Defaulting session.cookie_httponly to true seems very reasonable.

  • Beware that if you set session.cookie_secure to true, you will break websites that are not served across https. Moreover, the reason of the breakage may not be evident.

  • You forgot another obvious setting: session.cookie_samesite must be “Lax” by default.

  • We should also consider setting session.use_strict_mode to true, in order to mitigate session fixation attacks.

—Claude

3

On Fri, Sep 13, 2024 at 9:51 PM Claude Pache <claude.pache@gmail.com> wrote:

Le 13 sept. 2024 à 16:13, etkaar <etkaar@akayo.eu> a écrit :

Hi!

I've created this issue in January 2022 but it seems it wasn't noticed yet (since you probably do watch the mailing lists more than GitHub):
[https://github.com/php/php-src/issues/7913](https://github.com/php/php-src/issues/7913)

Kind Regards,
etkaar

Hi,

  • Defaulting session.cookie_httponly to true seems very reasonable.

  • Beware that if you set session.cookie_secure to true, you will break websites that are not served across https. Moreover, the reason of the breakage may not be evident.

  • You forgot another obvious setting: session.cookie_samesite must be “Lax” by default.

  • We should also consider setting session.use_strict_mode to true, in order to mitigate session fixation attacks.

—Claude

Hi,

Maybe, session.cookie_secure could use an additional value like 'auto' which would enable it for https and disable for http. Symfony does it too https://symfony.com/doc/current/reference/configuration/framework.html#cookie-secure

Kind regards,
Faizan