<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<title>Securing Session INI Settings</title>
</head>
<body><div class="manualnavbar" style="text-align: center;">
<div class="prev" style="text-align: left; float: left;"><a href="features.session.security.management.html">Session Management Basics</a></div>
<div class="next" style="text-align: right; float: right;"><a href="ref.session.html">Session Functions</a></div>
<div class="up"><a href="session.security.html">Sessions and Security</a></div>
<div class="home"><a href="index.html">PHP Manual</a></div>
</div><hr /><div id="session.security.ini" class="sect1">
<h2 class="title">Securing Session INI Settings</h2>
<p class="para">
By securing session related INI settings, you can improve session security.
Some of important INI settings do not have recommended settings. You
are responsible to hardening session settings.
</p>
<ul class="itemizedlist">
<li class="listitem">
<p class="para">
<a href="session.configuration.html#ini.session.cookie-lifetime" class="link">session.cookie_lifetime</a>=0
</p>
<p class="para">
0 have special meaning. It tells browsers not to store cookie to
permanent storage. Therefore, when browser is terminated, session
ID cookie is deleted immediately. If developer set other than 0, it may
allow other users to use the session ID. Most applications should
use "0" for this.
</p>
<p class="para">
If auto login feature is required, implement your own secure auto login
feature. Do not use long life session ID for it.
</p>
</li>
<li class="listitem">
<p class="para">
<a href="session.configuration.html#ini.session.use-cookies" class="link">session.use_cookies</a>=On
</p>
<p class="para">
<a href="session.configuration.html#ini.session.use-only-cookies" class="link">session.use_only_cookies</a>=On
</p>
<p class="para">
Although HTTP cookie has some problems, cookie is preferred way to
manage session ID. Use only cookies for session ID management when
it is possible. Most applications should use cookie for session
ID.
</p>
<p class="para">
If <em>session.use_only_cookies</em>=Off,
session module will use session ID values set by GET/POST/URL when
session ID cookie is not initialized already.
</p>
</li>
<li class="listitem">
<p class="para">
<a href="session.configuration.html#ini.session.use-strict-mode" class="link">session.use_strict_mode</a>=On
</p>
<p class="para">
Although, enabling <em>session.use_strict_mode</em> is
mandatory. It is not enabled by default.
</p>
<p class="para">
This prevents session module to use uninitialized session ID. In
other word, session module only accepts valid session ID generated
by session module. It rejects session ID supplied by
users.
</p>
<p class="para">
Because of cookie spec, attackers are able to set undeletable session ID
cookies via locally setting cookie database or JavaScript injections.
<em>session.use_strict_mode</em> can prevent attacker
initialized session ID being used.
</p>
<blockquote class="note"><p><strong class="note">Note</strong>:
<p class="para">
Attackers may initialize session ID by their device and may set the
session ID to victim. They must keep the session ID active to abuse.
Attackers require additional steps to perform attack with this attack
scenario. Therefore, <em>session.use_strict_mode</em> works
as the mitigation.
</p>
</p></blockquote>
</li>
<li class="listitem">
<p class="para">
<a href="session.configuration.html#ini.session.cookie-httponly" class="link">session.cookie_httponly</a>=On
</p>
<p class="para">
Disallow access to session cookie by JavaScript. This setting
prevents cookies stolen by JavaScript injection.
</p>
<p class="para">
It is possible to use session ID as CSRF protection key, but this is not
recommended. For example, HTML source may be saved and sent to
other users. Developer should not write session ID in web pages for
better security. Almost all applications must use httponly attribute for
session ID cookie.
</p>
<blockquote class="note"><p><strong class="note">Note</strong>:
<p class="para">
CSRF protection token should be renewed periodically just like
session ID
</p>
</p></blockquote>
</li>
<li class="listitem">
<p class="para">
<a href="session.configuration.html#ini.session.cookie-secure" class="link">session.cookie_secure</a>=On
</p>
<p class="para">
Allows access to session ID cookie only when protocol is HTTPS. If
your web site is HTTPS only web site, you must enable this
setting.
</p>
<p class="para">
HSTS should be considered for HTTPS only web site.
</p>
</li>
<li class="listitem">
<p class="para">
<a href="session.configuration.html#ini.session.gc-maxlifetime" class="link">session.gc_maxlifetime</a>=[choose smallest possible]
</p>
<p class="para">
<em>session.gc_maxlifetime</em>
is setting for deleting obsolete session ID. Reliance on this setting
is NOT recommend. You should manage session life time by time-stamp
by yourself.
</p>
<p class="para">
Session GC(garbage collection) is better to be performed by <span class="function"><a href="function.session-gc.html" class="function">session_gc()</a></span>.
<span class="function"><a href="function.session-gc.html" class="function">session_gc()</a></span> function is better to be executed by task
managers. e.g. cron on UNIX like systems.
</p>
<p class="para">
GC is performed by probability by default. This setting does not
guarantee old session deletion. Although developer cannot rely
on this setting, setting this to smallest possible value is
recommended. Adjust <a href="session.configuration.html#ini.session.gc-probability" class="link">session.gc_probability</a>
and <a href="session.configuration.html#ini.session.gc-divisor" class="link">session.gc_divisor</a> so
that obsolete sessions are deleted by appropriate frequency. If
auto login feature is required, implement your own secure auto
login feature. Never use long life session ID for it.
</p>
<blockquote class="note"><p><strong class="note">Note</strong>:
<p class="para">
Some session save handler modules do not use this setting for
probability based expiration . e.g. memcached, memcache.
Refer to session save handler documentation for details.
</p>
</p></blockquote>
</li>
<li class="listitem">
<p class="para">
<a href="session.configuration.html#ini.session.use-trans-sid" class="link">session.use_trans_sid</a>=Off
</p>
<p class="para">
Use of transparent session ID management is not prohibited. You
may use it when it is needed. However, disabling transparent
session ID management would improve general session ID security by
removing possibility of session ID injection and session ID leak.
</p>
<blockquote class="note"><p><strong class="note">Note</strong>:
<p class="para">
Session ID may leak from bookmarked URL, e-mailed URL, saved HTML
source.
</p>
</p></blockquote>
</li>
<li class="listitem">
<p class="para">
<a href="session.configuration.html#ini.session.trans-sid-tags" class="link">session.trans_sid_tags</a>=[limited tags]
</p>
<p class="para">
(PHP 7.1.0 >=) You should not rewrite unneeded HTML tags. Default
would be good enough for most usage. Older PHP uses
<a href="outcontrol.configuration.html#ini.url-rewriter.tags" class="link">url_rewriter.tags</a> for this.
</p>
</li>
<li class="listitem">
<p class="para">
<a href="session.configuration.html#ini.session.trans-sid-hosts" class="link">session.trans_sid_hosts</a>=[limited hosts]
</p>
<p class="para">
(PHP 7.1.0 >=) This INI defines whitelist hosts that allows trans sid
rewrite. Never add untrusted host. Session module allow only $_SERVER['HTTP_HOST']
when this setting is empty.
</p>
</li>
<li class="listitem">
<p class="para">
<a href="session.configuration.html#ini.session.referer-check" class="link">session.referer_check</a>=[your originating URL]
</p>
<p class="para">
When <a href="session.configuration.html#ini.session.use-trans-sid" class="link">session.use_trans_sid</a>
is enabled.
It reduces risk of session ID injection. If your site is
http://example.com/, set http://example.com/ to it. Note that when
HTTPS is used the browser will not send the referrer header. Browsers may
not send the referrer header by configuration. Use of this
setting is recommended Therefore, this setting
is not reliable security measure.
</p>
</li>
<li class="listitem">
<p class="para">
<a href="session.configuration.html#ini.session.cache-limiter" class="link">session.cache_limiter</a>=nocache
</p>
<p class="para">
Make sure HTTP contents are not cached for authenticated
session. Allow caching only when contents are not private.
Otherwise, contents may be exposed. "private" may be used
if HTTP content does not include security sensitive data. Note
that "private" may leave private data cached by shared
clients. "public" may be used only when HTTP content does not
contain any private data at all.
</p>
</li>
<li class="listitem">
<p class="para">
<a href="session.configuration.html#ini.session.sid-length" class="link">session.sid_length</a>="48"
</p>
<p class="para">
(PHP 7.1.0 >=) Longer session ID results in stronger session
ID. Developer should consider session ID length 32 chars or more. At
least 26 chars is required when
<a href="session.configuration.html#ini.session.sid-bits-per-character" class="link">session.sid_bits_per_character</a>="5".
</p>
</li>
<li class="listitem">
<p class="para">
<a href="session.configuration.html#ini.session.sid-bits-per-character" class="link">session.sid_bits_per_character</a>="6"
</p>
<p class="para">
(PHP 7.1.0 >=) The more bits in a session ID char, session module
generates stronger session ID for the same session ID length.
</p>
</li>
<li class="listitem">
<p class="para">
<a href="session.configuration.html#ini.session.hash-function" class="link">session.hash_function</a>="sha256"
</p>
<p class="para">
(PHP 7.1.0 <) Stronger hash function will generates stronger session
ID. Although hash collision is unlikely even with MD5 hash, developers
should use SHA-2 or stronger hash functions for the task. Developers may
use stronger hashes like sha384 and sha512. Make sure you feed long
enough <a href="session.configuration.html#ini.session.entropy-length" class="link">entropy</a> for
the hash function used.
</p>
</li>
</ul>
</div><hr /><div class="manualnavbar" style="text-align: center;">
<div class="prev" style="text-align: left; float: left;"><a href="features.session.security.management.html">Session Management Basics</a></div>
<div class="next" style="text-align: right; float: right;"><a href="ref.session.html">Session Functions</a></div>
<div class="up"><a href="session.security.html">Sessions and Security</a></div>
<div class="home"><a href="index.html">PHP Manual</a></div>
</div></body></html>
