Skip to content

ext/session: document the 8.4.0 INI deprecations, drop the removed hash_function recommendation #5800

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
lacatoire wants to merge 1 commit into
base: master
Choose a base branch
from
Open

ext/session: document the 8.4.0 INI deprecations, drop the removed hash_function recommendation #5800

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 23 additions & 7 deletions reference/session/ini.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -164,13 +164,19 @@
<entry><link linkend="ini.session.sid-length">session.sid_length</link></entry>
<entry>"32"</entry>
<entry><constant>INI_ALL</constant></entry>
<entry>Available as of PHP 7.1.0. Deprecated as of PHP 8.4.0.</entry>
<entry>
Available as of PHP 7.1.0.
Changing this setting is deprecated as of PHP 8.4.0.
</entry>
</row>
<row>
<entry><link linkend="ini.session.sid-bits-per-character">session.sid_bits_per_character</link></entry>
<entry>"4"</entry>
<entry><constant>INI_ALL</constant></entry>
<entry>Available as of PHP 7.1.0. Deprecated as of PHP 8.4.0.</entry>
<entry>
Available as of PHP 7.1.0.
Changing this setting is deprecated as of PHP 8.4.0.
</entry>
</row>
<row>
<entry><link linkend="ini.session.upload-progress.enabled">session.upload_progress.enabled</link></entry>
Expand Down Expand Up @@ -858,12 +864,18 @@
<literal>session.sid_bits_per_character</literal>, otherwise you
will have weaker session ID.
</para>
</tip>
</tip>
<note>
<simpara>
This setting is introduced in PHP 7.1.0.
Available as of PHP 7.1.0.
</simpara>
</note>
<warning>
<simpara>
Changing <literal>session.sid_length</literal> from its default
value is deprecated as of PHP 8.4.0.
</simpara>
</warning>
</listitem>
</varlistentry>

Expand All @@ -882,13 +894,17 @@
The default is 4. The more bits results in stronger session ID. 5 is
recommended value for most environments.
</simpara>
<para>
</para>
<note>
<simpara>
This setting is introduced in PHP 7.1.0.
Available as of PHP 7.1.0.
</simpara>
</note>
<warning>
<simpara>
Changing <literal>session.sid_bits_per_character</literal> from its
default value is deprecated as of PHP 8.4.0.
</simpara>
</warning>
</listitem>
</varlistentry>

Expand Down
58 changes: 32 additions & 26 deletions reference/session/security.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -649,12 +649,16 @@
<para>
<link linkend="ini.session.use-trans-sid">session.use_trans_sid</link>=Off
</para>
<para>
Use of a transparent session ID management is not prohibited.
Developers may employ it when it is required.
However, disabling transparent session ID management improves the general session
<simpara>
Disabling transparent session ID management improves the general session
ID security by eliminating the possibility of a session ID injection and/or leak.
</para>
</simpara>
<warning>
<simpara>
Enabling <link linkend="ini.session.use-trans-sid">session.use_trans_sid</link>
is deprecated as of PHP 8.4.0.
</simpara>
</warning>
<note>
<para>
Session ID may leak from bookmarked URLs, e-mailed URLs, saved HTML source, etc.
Expand All @@ -672,6 +676,12 @@
Older PHP versions use
<link linkend="ini.url-rewriter.tags">url_rewriter.tags</link> instead.
</para>
<warning>
<simpara>
Changing <link linkend="ini.session.trans-sid-tags">session.trans_sid_tags</link>
from its default value is deprecated as of PHP 8.4.0.
</simpara>
</warning>
</listitem>

<listitem>
Expand All @@ -684,24 +694,34 @@
Session module only allows <literal>$_SERVER['HTTP_HOST']</literal>
when this setting is empty.
</para>
<warning>
<simpara>
Setting <link linkend="ini.session.trans-sid-hosts">session.trans_sid_hosts</link>
to a non-empty value is deprecated as of PHP 8.4.0.
</simpara>
</warning>
</listitem>

<listitem>
<para>
<simpara>
<link linkend="ini.session.referer-check">session.referer_check</link>=[originating URL]
</para>
<para>
</simpara>
<simpara>
When <link
linkend="ini.session.use-trans-sid">session.use_trans_sid</link>
is enabled.
It reduces the risk of session ID injection.
is enabled, it reduces the risk of session ID injection.
If a website is <literal>http://example.com/</literal>,
set <literal>http://example.com/</literal> to it.
Note that with HTTPS browsers will not send the referrer header.
Browsers may not send the referrer header by configuration.
Therefore, this setting is not a reliable security measure.
Use of this setting is recommended.
</para>
</simpara>
<warning>
<simpara>
Setting <link linkend="ini.session.referer-check">session.referer_check</link>
to a non-empty value is deprecated as of PHP 8.4.0.
</simpara>
</warning>
</listitem>

<listitem>
Expand All @@ -721,20 +741,6 @@
</para>
</listitem>

<listitem>
<para>
<link linkend="ini.session.hash-function">session.hash_function</link>="sha256"
</para>
<para>
(PHP 7.1.0 &lt;) A stronger hash function will generate a stronger session ID.
Although hash collision is unlikely even with the MD5 hashing algorithm,
developers should use SHA-2 or a stronger hashing algorithm like sha384 and sha512.
Developers must ensure they feed a long enough
<link linkend="ini.session.entropy-length">entropy</link>
for the hashing function used.
</para>
</listitem>

<listitem>
<para>
<link linkend="ini.session.save-path">session.save_path</link>=[non world-readable directory]
Expand Down