session.use_strict_mode

INI • INI default value changed in 8.6

Session: session.use_strict_mode — Whether to use strict session mode. Strict session mode does not accept an uninitialized session ID, and regenerates the session ID if the browser sends an uninitialized session ID. Strict mode protects applications from session fixation via a session adoption vulnerability. https://wiki.php.net/rfc/strict_sessions


Default value	1
Development value	1
Production value	1

Modifiability: INI_ALL - The session.use_strict_mode INI directive can be configured anywhere, including php.ini files, ini_set calls, Apache .htaccess files, per-directory .ini files, etc.

PHP 5.3

PHP 5.4

Removed

PHP 5.5

Added

PHP 5.6

PHP 7

PHP 8.0-8.1

PHP 8.2-8.3

PHP 8.4

PHP 8.5

PHP 8.6

Changed

PHP 8.7

[Session]
session.use_strict_mode = 1

Changes to the `session.use_strict_mode` INI

PHP 8.6

INI directive default value changed from 0 to 1

PHP 5.5

INI directive added

PHP 5.4

INI directive removed