Lemmings Forums

Site Boards => Site Discussion => Topic started by: Mindless on February 03, 2025, 11:02:00 PM

Title: Disable PHPSESSID query parameter
Post by: Mindless on February 03, 2025, 11:02:00 PM
Setting session.use_only_cookies (https://www.php.net/manual/en/session.configuration.php#ini.session.use-only-cookies) to 1 should disable use of the PHPSESSID query parameter.  Enabling session.use_only_cookies protects against session hijacking when people share links (which is why the default is 1).

Also, when session.use_only_cookies is not enabled, all the URLs on the forum are unique each time a web spider accesses the site (which you can see on archive.org (http://web.archive.org/web/20250118000108/https://www.lemmingsforums.net/)).

Looks like SMF is specifically disabling session.use_only_cookies (https://github.com/SimpleMachines/SMF/blob/release-2.1/Sources/Session.php#L32), so this is probably what needs to change.  (See also: an issue on GitHub about it (https://github.com/SimpleMachines/SMF/issues/8383).)
Title: Re: Disable PHPSESSID query parameter
Post by: namida on February 05, 2025, 10:41:50 PM
It sounds like there shouldn't be any major issues from simply commenting out that line, so let's give that a try for now. I'll leave it in place for a few days and see if it causes any problems, and if not, I'll make that change permanent.