session.use_strict_mode

INI • INI default value changed in 8.6

Session: session.use_strict_mode — Whether to use strict session mode. Strict session mode does not accept an uninitialized session ID, and regenerates the session ID if the browser sends an uninitialized session ID. Strict mode protects applications from session fixation via a session adoption vulnerability. https://wiki.php.net/rfc/strict_sessions


Default value	1
Development value	1
Production value	1

Modifiability: INI_ALL - The session.use_strict_mode INI directive can be configured anywhere, including php.ini files, ini_set calls, Apache .htaccess files, per-directory .ini files, etc.

PHP 5.3-5.4

PHP 5.5

Added

PHP 5.6

PHP 7

PHP 8.0-8.1

PHP 8.2-8.3

PHP 8.4

PHP 8.5

PHP 8.6

Changed

[Session]
session.use_strict_mode = 1

Changes to the `session.use_strict_mode` INI

PHP 8.6

INI directive default value changed from 0 to 1

PHP 5.5

INI directive added