From db59ac1502f3bff8e6ea72336dbb0d7d5273b45d Mon Sep 17 00:00:00 2001 From: Louis-Arnaud Date: Sun, 16 Aug 2026 19:46:10 +0200 Subject: [PATCH] session: document the 8.4.0 INI deprecations, drop the removed hash_function recommendation The 8.4.0 session INI deprecations are conditional: PHP only emits E_DEPRECATED when a setting is moved away from its default value, so the wording says "changing" / "enabling" / "setting a non-empty value" rather than describing the settings themselves as deprecated. reference/session/ini.xml - session.sid_length and session.sid_bits_per_character: keep the availability note, add the deprecation as a , matching the other 8.4.0 deprecations in this file - align the two summary table rows with the same wording reference/session/security.xml - add the deprecation warnings for session.use_trans_sid, session.trans_sid_tags, session.trans_sid_hosts and session.referer_check - drop the session.hash_function recommendation, the setting was removed in PHP 7.1.0 - fix a sentence fragment in the session.referer_check item Sources - Changing session.sid_length / session.sid_bits_per_character: https://wiki.php.net/rfc/deprecations_php_8_4#sessionsid_length_and_sessionsid_bits_per_character ext/session/session.c (val != 32, val != 4 guards) - use_trans_sid, trans_sid_tags, trans_sid_hosts, referer_check: https://wiki.php.net/rfc/deprecate-get-post-sessions - session.hash_function removed in PHP 7.1.0 --- reference/session/ini.xml | 30 ++++++++++++++---- reference/session/security.xml | 58 +++++++++++++++++++--------------- 2 files changed, 55 insertions(+), 33 deletions(-) diff --git a/reference/session/ini.xml b/reference/session/ini.xml index 0e97a646762d..5f27d4d5e3d4 100644 --- a/reference/session/ini.xml +++ b/reference/session/ini.xml @@ -164,13 +164,19 @@ session.sid_length "32" INI_ALL - Available as of PHP 7.1.0. Deprecated as of PHP 8.4.0. + + Available as of PHP 7.1.0. + Changing this setting is deprecated as of PHP 8.4.0. + session.sid_bits_per_character "4" INI_ALL - Available as of PHP 7.1.0. Deprecated as of PHP 8.4.0. + + Available as of PHP 7.1.0. + Changing this setting is deprecated as of PHP 8.4.0. + session.upload_progress.enabled @@ -858,12 +864,18 @@ session.sid_bits_per_character, otherwise you will have weaker session ID. - + - This setting is introduced in PHP 7.1.0. + Available as of PHP 7.1.0. + + + Changing session.sid_length from its default + value is deprecated as of PHP 8.4.0. + + @@ -882,13 +894,17 @@ The default is 4. The more bits results in stronger session ID. 5 is recommended value for most environments. - - - This setting is introduced in PHP 7.1.0. + Available as of PHP 7.1.0. + + + Changing session.sid_bits_per_character from its + default value is deprecated as of PHP 8.4.0. + + diff --git a/reference/session/security.xml b/reference/session/security.xml index ac1927417787..4ba422070090 100644 --- a/reference/session/security.xml +++ b/reference/session/security.xml @@ -649,12 +649,16 @@ session.use_trans_sid=Off - - Use of a transparent session ID management is not prohibited. - Developers may employ it when it is required. - However, disabling transparent session ID management improves the general session + + Disabling transparent session ID management improves the general session ID security by eliminating the possibility of a session ID injection and/or leak. - + + + + Enabling session.use_trans_sid + is deprecated as of PHP 8.4.0. + + Session ID may leak from bookmarked URLs, e-mailed URLs, saved HTML source, etc. @@ -672,6 +676,12 @@ Older PHP versions use url_rewriter.tags instead. + + + Changing session.trans_sid_tags + from its default value is deprecated as of PHP 8.4.0. + + @@ -684,24 +694,34 @@ Session module only allows $_SERVER['HTTP_HOST'] when this setting is empty. + + + Setting session.trans_sid_hosts + to a non-empty value is deprecated as of PHP 8.4.0. + + - + session.referer_check=[originating URL] - - + + When session.use_trans_sid - is enabled. - It reduces the risk of session ID injection. + is enabled, it reduces the risk of session ID injection. If a website is http://example.com/, set http://example.com/ to it. Note that with HTTPS browsers will not send the referrer header. Browsers may not send the referrer header by configuration. Therefore, this setting is not a reliable security measure. - Use of this setting is recommended. - + + + + Setting session.referer_check + to a non-empty value is deprecated as of PHP 8.4.0. + + @@ -721,20 +741,6 @@ - - - session.hash_function="sha256" - - - (PHP 7.1.0 <) A stronger hash function will generate a stronger session ID. - Although hash collision is unlikely even with the MD5 hashing algorithm, - developers should use SHA-2 or a stronger hashing algorithm like sha384 and sha512. - Developers must ensure they feed a long enough - entropy - for the hashing function used. - - - session.save_path=[non world-readable directory]