[php-src] Issue #7913: Vulnerability due to insecure default values for session.cookie_secure and session.cookie_httponly
| From: | cmb69 | Date: | Tue, 11 Jan 2022 14:32:34 +0000 |
| Subject: | [php-src] Issue #7913: Vulnerability due to insecure default values for session.cookie_secure and session.cookie_httponly | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-238967@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/7913
Comment Author: cmb69
Indeed,
session.cookie_secure and session.cookie_httponly default to off.
I don't consider this to be a bug, though, especially since there is explicit [documentation
about securing session INI settings](https://www.php.net/manual/en/session.security.ini.php).
I'm not against changing the defaults for the next minor version, though.