Refuse session ids that PHP did not make.

2026-09-26 15:27:51 +02:00
parent 30b275b902
commit ed8918e7fd
3 changed files with 15 additions and 0 deletions
@@ -13,6 +13,8 @@ if (isset($_SERVER['HTTPS'])) {
  // Browsers use HTTPS for this host for a year, without a plain request first
  header('Strict-Transport-Security: max-age=31536000');
  session_cache_limiter('private');
+  // Refuse a session id that PHP did not make, so nobody can plant one
+  ini_set('session.use_strict_mode', '1');
  session_set_cookie_params(array('lifetime' => 0, 'path' => '/', 'domain' => cookie_domain(), 'secure' => TRUE, 'httponly' => TRUE, 'samesite' => 'Lax'));
  session_start();