note 115480 added to function.session-set-cookie-params

Be aware of a pair of dangerous gotchas with this: Firstly, setting a cookie expiration (other than zero) changes the cookie into a persistent one; in which case it is no longer strictly a session cookie at all. You might think that setting an expiry time is the security-conscious thing to do, in fact doing so creates a vuln in that the session will then persist until the timeout, regardless of browser closedown or even computer reboot. Secondly, some browsers fail to expire session cookies at shutdown when "restore my previous sessions at startup" is selected -which in some browsers is now the default. Again, this can lead to a situation where an unauthorised person gaining access to a computer may be able to access websites under an impersonated ID, even though the computer has been properly shut down prior to the intrusion. ---- Server IP: 72.52.91.14 Probable Submitter: 212.159.68.116 ---- Manual Page -- http://php.net/manual/en/function.session-set-cookie-params.php Edit -- https://master.php.net/note/edit/115480 Del: integrated -- https://master.php.net/note/delete/115480/integrated Del: useless -- https://master.php.net/note/delete/115480/useless Del: bad code -- https://master.php.net/note/delete/115480/bad+code Del: spam -- https://master.php.net/note/delete/115480/spam Del: non-english -- https://master.php.net/note/delete/115480/non-english Del: in docs -- https://master.php.net/note/delete/115480/in+docs Del: other reasons-- https://master.php.net/note/delete/115480 Reject -- https://master.php.net/note/reject/115480 Search -- https://master.php.net/manage/user-notes.php