Bug #77238 [Opn]: session_set_cookie_params behavior change in PHP 7.2

Edit report at https://bugs.php.net/bug.php?id=77238&edit=1 ID: 77238 User updated by: john at zerocrates dot org Reported by: john at zerocrates dot org Summary: session_set_cookie_params behavior change in PHP 7.2 Status: Open Type: Bug Package: Session related Operating System: Linux PHP Version: 7.2.12 Block user comment: N Private report: N New Comment: Bug #76358 seems to be a different facet of the same basic problem or change. Previous Comments: ------------------------------------------------------------------------ [2018-12-04 18:58:22] john at zerocrates dot org Description: ------------ Under PHP 7.1, calling session_set_cookie_params with an active session will successfully change the cookie sent to the client, IF session_regenerate_id is called afterward. In PHP 7.2, calling session_set_cookie_params with an active session emits a warning: Warning: session_set_cookie_params(): Cannot change session cookie parameters when session is active Additionally, the cookie is _not_ changed. I've seen this described as a change which merely emits warnings informing developers of patterns that never worked in the first place and just failed silently (for example, the comments on #75650), but in this case presumably the function is bailing out after printing the warning, and the actual behavior is changed. I was unable to find any discussion of this change in the migration documentation for PHP 7.2. Test script: --------------- session_start(); $params = session_get_cookie_params(); session_set_cookie_params(100, $params['path'], $params['domain'], $params['secure']); session_regenerate_id(); // Under 7.1 this emits a Set-Cookie with the 100-second lifetime respected // Under 7.2, it produces a warning and the Set-Cookie does not respect the new lifetime ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=77238&edit=1