Re: [VOTE] Same Site Cookie RFC

On Sun, Jul 22, 2018 at 1:21 AM, Pedro Magalhães <mail@pmmaga.net> wrote: > On Sat, Jul 21, 2018 at 11:26 PM Andrey Andreev <narf@devilix.net> wrote: > > > Yes. > > > > All other "options" are actual *cookie attribute* names, as defined by > > the various IETF RFCs, while "lifetime" is just a convenient name used > > by PHP. It doesn't correspond to a particular attribute, but instead > > the values for the Expires and Max-Age attributes are derived from it. > > I believe during discussion I insisted that the parameter be called > > "attributes", for this very reason. > > > > Hi, > > While I do understand your reasoning, I find it extremely unfriendly to the > user of the function to ask for one parameter separate from all the others > for that reason alone. > Also, keep in mind that all this function does is set the > session.cookie_* ini entries. So all parameters are treated > equally. > To add to this, session_get_cookie_params() already returns all parameters including "lifetime" in one array. It would be very weird if there was an asymmetry between session_get_cookie_params() and session_set_cookie_params(). Furthermore, the way I have seen session_set_cookie_params() used, it has pretty much always been in conjunction with a prior session_get_cookie_params() call to get the current values and then only one (or some) of them being adjusted. It makes more sense to write $params = session_get_cookie_params(); // Change $params here session_set_cookie_params($params); than having to treat just the $params["lifetime"] case specially. Nikita > On another note, I also wanted that pretty much any key/value pair to > > be accepted instead of raising an error, for forward compatibility. > > > > I really believe that the user spotting errors like `['expries' => time() + > 3600]` faster is more valuable than FC. > > Regards, > Pedro >