Skip to content

Improve session config and cookie store (part of #7685) #7689

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Zoey2936 wants to merge 2 commits into
base: main
Choose a base branch
from
+10 −8
Open

Improve session config and cookie store (part of #7685) #7689

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2a803f3
Improve session config and cookie store (part of #7685)
Zoey2936 Mar 4, 2026
b92ecb3
add comments
Zoey2936 Mar 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 10 additions & 8 deletions php/public/index.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,13 +23,6 @@

$container = \AIO\DependencyInjection::GetContainer();
$dataConst = $container->get(\AIO\Data\DataConst::class);
ini_set('session.save_path', $dataConst->GetSessionDirectory());
Copy link
Collaborator Author

@Zoey2936 Zoey2936 Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

moved to session_start


// Auto logout on browser close
ini_set('session.cookie_lifetime', '0');
Copy link
Collaborator Author

@Zoey2936 Zoey2936 Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I removed this since it is the default


# Keep session for 24h max
ini_set('session.gc_maxlifetime', '86400');
Copy link
Collaborator Author

@Zoey2936 Zoey2936 Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

moved to session_start


// Create app
AppFactory::setContainer($container);
Expand All @@ -44,7 +37,16 @@
});

// Register Middleware To Be Executed On All Routes
session_start();
session_start([
"save_path" => $dataConst->GetSessionDirectory(), // where to save the session files
"gc_maxlifetime" => 86400, // delete sessions after 24 hours ... // https://www.php.net/manual/en/session.configuration.php#ini.session.gc-maxlifetime
"gc_probability" => 1, // ... to ... // https://www.php.net/manual/en/session.configuration.php#ini.session.gc-probability
"gc_divisor" => 1, // 100% // https://www.php.net/manual/en/session.configuration.php#ini.session.gc-divisor
"use_strict_mode" => true, // only allow initialized session IDs // https://www.php.net/manual/en/session.configuration.php#ini.session.use-strict-mode
"cookie_secure" => true, // only send cookies over https (not http) // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie#secure
"cookie_httponly" => true, // block the cookie from being read with js in the browser, will still be send for fetch request triggered by js // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie#httponly
"cookie_samesite" => "Strict", // only send the cookie with requests triggered by AIO itself // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie#samesitesamesite-value
]);
$app->add(Guard::class);

// Create Twig
Expand Down
Loading