diff --git a/functions/session.xml b/functions/session.xml index c737742463..9b5e8230e9 100644 --- a/functions/session.xml +++ b/functions/session.xml @@ -274,12 +274,10 @@ close - session.referer_check determines whether - session ids referred to by external sites will be - eliminated. If session ids are propagated using the URL method, - users not knowing about the impact might publish session - ids. This can lead to security problems which this check tries - to defeat. Defaults to 0. + session.referer_check contains the substring you + want to check each HTTP Referer for. If the Referer was sent by the + client and the substring was not found, an embedded session id will + be marked as invalidate. Defaults to the empty string.