mirror of
https://github.com/sigmasternchen/php-doc-en
synced 2025-03-16 00:48:54 +00:00
afcc3eb1fd
Inspired by a patch provided by Miroslav Banov. git-svn-id: https://svn.php.net/repository/phpdoc/en/trunk@345391 c90b9560-bf6c-de11-be94-00142212c4b1
1086 lines
36 KiB
XML
1086 lines
36 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<!-- $Revision$ -->
|
|
<section xml:id="session.configuration" xmlns="http://docbook.org/ns/docbook">
|
|
&reftitle.runtime;
|
|
&extension.runtime;
|
|
<para>
|
|
<table>
|
|
<title>Session configuration options</title>
|
|
<tgroup cols="4">
|
|
<thead>
|
|
<row>
|
|
<entry>&Name;</entry>
|
|
<entry>&Default;</entry>
|
|
<entry>&Changeable;</entry>
|
|
<entry>&Changelog;</entry>
|
|
</row>
|
|
</thead>
|
|
<tbody>
|
|
<row>
|
|
<entry><link linkend="ini.session.save-path">session.save_path</link></entry>
|
|
<entry>""</entry>
|
|
<entry>PHP_INI_ALL</entry>
|
|
<entry></entry>
|
|
</row>
|
|
<row>
|
|
<entry><link linkend="ini.session.name">session.name</link></entry>
|
|
<entry>"PHPSESSID"</entry>
|
|
<entry>PHP_INI_ALL</entry>
|
|
<entry></entry>
|
|
</row>
|
|
<row>
|
|
<entry><link linkend="ini.session.save-handler">session.save_handler</link></entry>
|
|
<entry>"files"</entry>
|
|
<entry>PHP_INI_ALL</entry>
|
|
<entry></entry>
|
|
</row>
|
|
<row>
|
|
<entry><link linkend="ini.session.auto-start">session.auto_start</link></entry>
|
|
<entry>"0"</entry>
|
|
<entry>PHP_INI_PERDIR</entry>
|
|
<entry></entry>
|
|
</row>
|
|
<row>
|
|
<entry><link linkend="ini.session.gc-probability">session.gc_probability</link></entry>
|
|
<entry>"1"</entry>
|
|
<entry>PHP_INI_ALL</entry>
|
|
<entry></entry>
|
|
</row>
|
|
<row>
|
|
<entry><link linkend="ini.session.gc-divisor">session.gc_divisor</link></entry>
|
|
<entry>"100"</entry>
|
|
<entry>PHP_INI_ALL</entry>
|
|
<entry></entry>
|
|
</row>
|
|
<row>
|
|
<entry><link linkend="ini.session.gc-maxlifetime">session.gc_maxlifetime</link></entry>
|
|
<entry>"1440"</entry>
|
|
<entry>PHP_INI_ALL</entry>
|
|
<entry></entry>
|
|
</row>
|
|
<row>
|
|
<entry><link linkend="ini.session.serialize-handler">session.serialize_handler</link></entry>
|
|
<entry>"php"</entry>
|
|
<entry>PHP_INI_ALL</entry>
|
|
<entry></entry>
|
|
</row>
|
|
<row>
|
|
<entry><link linkend="ini.session.cookie-lifetime">session.cookie_lifetime</link></entry>
|
|
<entry>"0"</entry>
|
|
<entry>PHP_INI_ALL</entry>
|
|
<entry></entry>
|
|
</row>
|
|
<row>
|
|
<entry><link linkend="ini.session.cookie-path">session.cookie_path</link></entry>
|
|
<entry>"/"</entry>
|
|
<entry>PHP_INI_ALL</entry>
|
|
<entry></entry>
|
|
</row>
|
|
<row>
|
|
<entry><link linkend="ini.session.cookie-domain">session.cookie_domain</link></entry>
|
|
<entry>""</entry>
|
|
<entry>PHP_INI_ALL</entry>
|
|
<entry></entry>
|
|
</row>
|
|
<row>
|
|
<entry><link linkend="ini.session.cookie-secure">session.cookie_secure</link></entry>
|
|
<entry>""</entry>
|
|
<entry>PHP_INI_ALL</entry>
|
|
<entry></entry>
|
|
</row>
|
|
<row>
|
|
<entry><link linkend="ini.session.cookie-httponly">session.cookie_httponly</link></entry>
|
|
<entry>""</entry>
|
|
<entry>PHP_INI_ALL</entry>
|
|
<entry>Available since PHP 5.2.0.</entry>
|
|
</row>
|
|
<row>
|
|
<entry><link linkend="ini.session.use-strict-mode">session.use_strict_mode</link></entry>
|
|
<entry>"0"</entry>
|
|
<entry>PHP_INI_ALL</entry>
|
|
<entry>Available since PHP 5.5.2.</entry>
|
|
</row>
|
|
<row>
|
|
<entry><link linkend="ini.session.use-cookies">session.use_cookies</link></entry>
|
|
<entry>"1"</entry>
|
|
<entry>PHP_INI_ALL</entry>
|
|
<entry></entry>
|
|
</row>
|
|
<row>
|
|
<entry><link linkend="ini.session.use-only-cookies">session.use_only_cookies</link></entry>
|
|
<entry>"1"</entry>
|
|
<entry>PHP_INI_ALL</entry>
|
|
<entry></entry>
|
|
</row>
|
|
<row>
|
|
<entry><link linkend="ini.session.referer-check">session.referer_check</link></entry>
|
|
<entry>""</entry>
|
|
<entry>PHP_INI_ALL</entry>
|
|
<entry></entry>
|
|
</row>
|
|
<row>
|
|
<entry><link linkend="ini.session.cache-limiter">session.cache_limiter</link></entry>
|
|
<entry>"nocache"</entry>
|
|
<entry>PHP_INI_ALL</entry>
|
|
<entry></entry>
|
|
</row>
|
|
<row>
|
|
<entry><link linkend="ini.session.cache-expire">session.cache_expire</link></entry>
|
|
<entry>"180"</entry>
|
|
<entry>PHP_INI_ALL</entry>
|
|
<entry></entry>
|
|
</row>
|
|
<row>
|
|
<entry><link linkend="ini.session.use-trans-sid">session.use_trans_sid</link></entry>
|
|
<entry>"0"</entry>
|
|
<entry>PHP_INI_ALL</entry>
|
|
<entry></entry>
|
|
</row>
|
|
<row>
|
|
<entry><link linkend="ini.session.trans-sid-tags">session.trans_sid_tags</link></entry>
|
|
<entry>"a=href,area=href,frame=src,form="</entry>
|
|
<entry>PHP_INI_ALL</entry>
|
|
<entry>Available since PHP 7.1.0.</entry>
|
|
</row>
|
|
<row>
|
|
<entry><link linkend="ini.session.trans-sid-hosts">session.trans_sid_hosts</link></entry>
|
|
<entry><literal>$_SERVER['HTTP_HOST']</literal></entry>
|
|
<entry>PHP_INI_ALL</entry>
|
|
<entry>Available since PHP 7.1.0.</entry>
|
|
</row>
|
|
<row>
|
|
<entry><link linkend="ini.session.sid-length">session.sid_length</link></entry>
|
|
<entry>"32"</entry>
|
|
<entry>PHP_INI_ALL</entry>
|
|
<entry>Available since PHP 7.1.0.</entry>
|
|
</row>
|
|
<row>
|
|
<entry><link linkend="ini.session.sid-bits-per-character">session.sid_bits_per_character</link></entry>
|
|
<entry>"5"</entry>
|
|
<entry>PHP_INI_ALL</entry>
|
|
<entry>Available since PHP 7.1.0.</entry>
|
|
</row>
|
|
<row>
|
|
<entry><link linkend="ini.session.upload-progress.enabled">session.upload_progress.enabled</link></entry>
|
|
<entry>"1"</entry>
|
|
<entry>PHP_INI_PERDIR</entry>
|
|
<entry>Available since PHP 5.4.0.</entry>
|
|
</row>
|
|
<row>
|
|
<entry><link linkend="ini.session.upload-progress.cleanup">session.upload_progress.cleanup</link></entry>
|
|
<entry>"1"</entry>
|
|
<entry>PHP_INI_PERDIR</entry>
|
|
<entry>Available since PHP 5.4.0.</entry>
|
|
</row>
|
|
<row>
|
|
<entry><link linkend="ini.session.upload-progress.prefix">session.upload_progress.prefix</link></entry>
|
|
<entry>"upload_progress_"</entry>
|
|
<entry>PHP_INI_PERDIR</entry>
|
|
<entry>Available since PHP 5.4.0.</entry>
|
|
</row>
|
|
<row>
|
|
<entry><link linkend="ini.session.upload-progress.name">session.upload_progress.name</link></entry>
|
|
<entry>"PHP_SESSION_UPLOAD_PROGRESS"</entry>
|
|
<entry>PHP_INI_PERDIR</entry>
|
|
<entry>Available since PHP 5.4.0.</entry>
|
|
</row>
|
|
<row>
|
|
<entry><link linkend="ini.session.upload-progress.freq">session.upload_progress.freq</link></entry>
|
|
<entry>"1%"</entry>
|
|
<entry>PHP_INI_PERDIR</entry>
|
|
<entry>Available since PHP 5.4.0.</entry>
|
|
</row>
|
|
<row>
|
|
<entry><link linkend="ini.session.upload-progress.min-freq">session.upload_progress.min_freq</link></entry>
|
|
<entry>"1"</entry>
|
|
<entry>PHP_INI_PERDIR</entry>
|
|
<entry>Available since PHP 5.4.0.</entry>
|
|
</row>
|
|
<row>
|
|
<entry><link linkend="ini.session.lazy-write">session.lazy_write</link></entry>
|
|
<entry>"1"</entry>
|
|
<entry>PHP_INI_ALL</entry>
|
|
<entry>Available since PHP 7.0.0.</entry>
|
|
</row>
|
|
<row>
|
|
<entry><link linkend="ini.url-rewriter.tags">url_rewriter.tags</link></entry>
|
|
<entry>"a=href,area=href,frame=src,form="</entry>
|
|
<entry>PHP_INI_ALL</entry>
|
|
<entry>Since PHP 7.1.0, this INI is no longer used by session.</entry>
|
|
</row>
|
|
<row>
|
|
<entry><link linkend="ini.session.hash-function">session.hash_function</link></entry>
|
|
<entry>"0"</entry>
|
|
<entry>PHP_INI_ALL</entry>
|
|
<entry>Removed in PHP 7.1.0.</entry>
|
|
</row>
|
|
<row>
|
|
<entry><link linkend="ini.session.hash-bits-per-character">session.hash_bits_per_character</link></entry>
|
|
<entry>"4"</entry>
|
|
<entry>PHP_INI_ALL</entry>
|
|
<entry>Removed in PHP 7.1.0.</entry>
|
|
</row>
|
|
<row>
|
|
<entry><link linkend="ini.session.entropy-file">session.entropy_file</link></entry>
|
|
<entry>""</entry>
|
|
<entry>PHP_INI_ALL</entry>
|
|
<entry>Removed in PHP 7.1.0.</entry>
|
|
</row>
|
|
<row>
|
|
<entry><link linkend="ini.session.entropy-length">session.entropy_length</link></entry>
|
|
<entry>"0"</entry>
|
|
<entry>PHP_INI_ALL</entry>
|
|
<entry>Removed in PHP 7.1.0</entry>
|
|
</row>
|
|
<row>
|
|
<entry><link linkend="ini.session.bug-compat-42">session.bug_compat_42</link></entry>
|
|
<entry>"1"</entry>
|
|
<entry>PHP_INI_ALL</entry>
|
|
<entry>Removed in PHP 5.4.0.</entry>
|
|
</row>
|
|
<row>
|
|
<entry><link linkend="ini.session.bug-compat-warn">session.bug_compat_warn</link></entry>
|
|
<entry>"1"</entry>
|
|
<entry>PHP_INI_ALL</entry>
|
|
<entry>Removed in PHP 5.4.0.</entry>
|
|
</row>
|
|
</tbody>
|
|
</tgroup>
|
|
</table>
|
|
&ini.php.constants;
|
|
</para>
|
|
<para>
|
|
The session management system supports a number of configuration
|
|
options which you can place in your &php.ini; file. We will give a
|
|
short overview.
|
|
<variablelist>
|
|
|
|
<varlistentry xml:id="ini.session.save-handler">
|
|
<term>
|
|
<parameter>session.save_handler</parameter>
|
|
<type>string</type>
|
|
</term>
|
|
<listitem>
|
|
<simpara>
|
|
<literal>session.save_handler</literal> defines the name of the
|
|
handler which is used for storing and retrieving data
|
|
associated with a session. Defaults to
|
|
<literal>files</literal>. Note that individual extensions may register
|
|
their own <literal>save_handler</literal>s; registered handlers can be
|
|
obtained on a per-installation basis by referring to
|
|
<function>phpinfo</function>. See also
|
|
<function>session_set_save_handler</function>.
|
|
</simpara>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry xml:id="ini.session.save-path">
|
|
<term>
|
|
<parameter>session.save_path</parameter>
|
|
<type>string</type>
|
|
</term>
|
|
<listitem>
|
|
<simpara>
|
|
<literal>session.save_path</literal> defines the argument which
|
|
is passed to the save handler. If you choose the default files
|
|
handler, this is the path where the files are created. See also
|
|
<function>session_save_path</function>.
|
|
</simpara>
|
|
<para>
|
|
There is an optional <literal>N</literal> argument to this directive that determines
|
|
the number of directory levels your session files will be spread
|
|
around in. For example, setting to <literal>'5;/tmp'</literal>
|
|
may end up creating a session file and location like
|
|
<literal>/tmp/4/b/1/e/3/sess_4b1e384ad74619bd212e236e52a5a174If
|
|
</literal>. In order to use <literal>N</literal> you must create all of these
|
|
directories before use. A small shell script exists in
|
|
<filename>ext/session</filename> to do this, it's called
|
|
<filename>mod_files.sh</filename>, with a Windows version called
|
|
<filename>mod_files.bat</filename>. Also note that if <literal>N</literal> is
|
|
used and greater than 0 then automatic garbage collection will
|
|
not be performed, see a copy of &php.ini; for further
|
|
information. Also, if you use <literal>N</literal>, be sure to surround
|
|
<literal>session.save_path</literal> in
|
|
"quotes" because the separator (<literal>;</literal>) is
|
|
also used for comments in &php.ini;.
|
|
</para>
|
|
<para>
|
|
The file storage module creates files using mode 600 by default.
|
|
This default can be changed with the optional <literal>MODE</literal> argument:
|
|
<literal>N;MODE;/path</literal> where <literal>MODE</literal> is the octal
|
|
representation of the mode.
|
|
Setting <literal>MODE</literal> does not affect the process umask.
|
|
</para>
|
|
<warning>
|
|
<para>
|
|
If you leave this set to a world-readable directory, such as
|
|
<filename>/tmp</filename> (the default), other users on the
|
|
server may be able to hijack sessions by getting the list of
|
|
files in that directory.
|
|
</para>
|
|
</warning>
|
|
<caution>
|
|
<para>
|
|
When using the optional directory level argument <literal>N</literal>,
|
|
as described above, note that using a value higher than 1 or 2 is
|
|
inappropriate for most sites due to the large number of directories
|
|
required: for example, a value of 3 implies that <literal>(2 ** session.sid_bits_per_character) ** 3</literal>
|
|
directories exist on the filesystem, which can result in a lot of wasted
|
|
space and inodes.
|
|
</para>
|
|
<para>
|
|
Only use <literal>N</literal> greater than 2 if you are absolutely
|
|
certain that your site is large enough to require it.
|
|
</para>
|
|
</caution>
|
|
<note>
|
|
<simpara>
|
|
Prior to PHP 4.3.6, Windows users had to change this variable in order
|
|
to use PHP's session functions. A valid path must be specified, e.g.:
|
|
<filename>c:/temp</filename>.
|
|
</simpara>
|
|
</note>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry xml:id="ini.session.name">
|
|
<term>
|
|
<parameter>session.name</parameter>
|
|
<type>string</type>
|
|
</term>
|
|
<listitem>
|
|
<simpara>
|
|
<literal>session.name</literal> specifies the name of the
|
|
session which is used as cookie name. It should only contain
|
|
alphanumeric characters. Defaults to <literal>PHPSESSID</literal>.
|
|
See also <function>session_name</function>.
|
|
</simpara>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry xml:id="ini.session.auto-start">
|
|
<term>
|
|
<parameter>session.auto_start</parameter>
|
|
<type>boolean</type>
|
|
</term>
|
|
<listitem>
|
|
<simpara>
|
|
<literal>session.auto_start</literal> specifies whether the
|
|
session module starts a session automatically on request
|
|
startup. Defaults to <literal>0</literal> (disabled).
|
|
</simpara>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry xml:id="ini.session.serialize-handler">
|
|
<term>
|
|
<parameter>session.serialize_handler</parameter>
|
|
<type>string</type>
|
|
</term>
|
|
<listitem>
|
|
<simpara>
|
|
<literal>session.serialize_handler</literal> defines the name of
|
|
the handler which is used to serialize/deserialize data. PHP
|
|
serialize format (name <literal>php_serialize</literal>), PHP
|
|
internal formats (name <literal>php</literal> and
|
|
<literal>php_binary</literal>) and WDDX are supported (name
|
|
<literal>wddx</literal>). WDDX is only available, if PHP is
|
|
compiled with <link linkend="ref.wddx">WDDX
|
|
support</link>. <literal>php_serialize</literal> is available
|
|
from PHP 5.5.4. <literal>php_serialize</literal> uses plain
|
|
serialize/unserialize function internally and does not have
|
|
limitations that <literal>php</literal>
|
|
and <literal>php_binary</literal> have. Older serialize handlers
|
|
cannot store numeric index nor string index contains special
|
|
characters (<literal>|</literal> and <literal>!</literal>) in
|
|
$_SESSION. Use <literal>php_serialize</literal> to avoid numeric
|
|
index or special character errors at script shutdown. Defaults
|
|
to <literal>php</literal>.
|
|
</simpara>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry xml:id="ini.session.gc-probability">
|
|
<term>
|
|
<parameter>session.gc_probability</parameter>
|
|
<type>integer</type>
|
|
</term>
|
|
<listitem>
|
|
<simpara>
|
|
<literal>session.gc_probability</literal> in conjunction with
|
|
<literal>session.gc_divisor</literal> is used to manage probability
|
|
that the gc (garbage collection) routine is started.
|
|
Defaults to <literal>1</literal>. See <link
|
|
linkend="ini.session.gc-divisor">session.gc_divisor</link> for details.
|
|
</simpara>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry xml:id="ini.session.gc-divisor">
|
|
<term>
|
|
<parameter>session.gc_divisor</parameter>
|
|
<type>integer</type>
|
|
</term>
|
|
<listitem>
|
|
<simpara>
|
|
<literal>session.gc_divisor</literal> coupled with
|
|
<literal>session.gc_probability</literal> defines the probability
|
|
that the gc (garbage collection) process is started on every session
|
|
initialization.
|
|
The probability is calculated by using gc_probability/gc_divisor,
|
|
e.g. 1/100 means there is a 1% chance that the GC process starts
|
|
on each request.
|
|
<literal>session.gc_divisor</literal> defaults to <literal>100</literal>.
|
|
</simpara>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry xml:id="ini.session.gc-maxlifetime">
|
|
<term>
|
|
<parameter>session.gc_maxlifetime</parameter>
|
|
<type>integer</type>
|
|
</term>
|
|
<listitem>
|
|
<simpara>
|
|
<literal>session.gc_maxlifetime</literal> specifies the number
|
|
of seconds after which data will be seen as 'garbage' and
|
|
potentially cleaned up. Garbage collection may occur during session start
|
|
(depending on <link
|
|
linkend="ini.session.gc-probability">session.gc_probability</link> and
|
|
<link linkend="ini.session.gc-divisor">session.gc_divisor</link>).
|
|
</simpara>
|
|
<note>
|
|
<simpara>
|
|
If different scripts have different values of
|
|
<literal>session.gc_maxlifetime</literal> but share the same place for
|
|
storing the session data then the script with the minimum value will be
|
|
cleaning the data. In this case, use this directive together with <link
|
|
linkend="ini.session.save-path">session.save_path</link>.
|
|
</simpara>
|
|
</note>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry xml:id="ini.session.referer-check">
|
|
<term>
|
|
<parameter>session.referer_check</parameter>
|
|
<type>string</type>
|
|
</term>
|
|
<listitem>
|
|
<simpara>
|
|
<literal>session.referer_check</literal> contains the
|
|
substring you want to check each HTTP Referer for. If the
|
|
Referer was sent by the client and the substring was not
|
|
found, the embedded session id will be marked as invalid.
|
|
Defaults to the empty string.
|
|
</simpara>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry xml:id="ini.session.entropy-file">
|
|
<term>
|
|
<parameter>session.entropy_file</parameter>
|
|
<type>string</type>
|
|
</term>
|
|
<listitem>
|
|
<simpara>
|
|
<literal>session.entropy_file</literal> gives a path to an
|
|
external resource (file) which will be used as an additional
|
|
entropy source in the session id creation process. Examples are
|
|
<literal>/dev/random</literal> or <literal>/dev/urandom</literal>
|
|
which are available on many Unix systems.
|
|
</simpara>
|
|
<simpara>
|
|
This feature is supported on Windows since PHP 5.3.3. Setting
|
|
<literal>session.entropy_length</literal> to a non zero value
|
|
will make PHP use the Windows Random API as entropy source.
|
|
</simpara>
|
|
<note>
|
|
<simpara>
|
|
Removed in PHP 7.1.0.
|
|
</simpara>
|
|
<simpara>
|
|
As of PHP 5.4.0 <literal>session.entropy_file</literal> defaults
|
|
to <literal>/dev/urandom</literal> or <literal>/dev/arandom</literal>
|
|
if it is available. In PHP 5.3.0 this directive is left empty by default.
|
|
</simpara>
|
|
</note>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry xml:id="ini.session.entropy-length">
|
|
<term>
|
|
<parameter>session.entropy_length</parameter>
|
|
<type>integer</type>
|
|
</term>
|
|
<listitem>
|
|
<simpara>
|
|
<literal>session.entropy_length</literal> specifies the number
|
|
of bytes which will be read from the file specified
|
|
above. Defaults to <literal>32</literal>.
|
|
</simpara>
|
|
<simpara>
|
|
Removed in PHP 7.1.0.
|
|
</simpara>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry xml:id="ini.session.use-strict-mode">
|
|
<term>
|
|
<parameter>session.use_strict_mode</parameter>
|
|
<type>boolean</type>
|
|
</term>
|
|
<listitem>
|
|
<simpara>
|
|
<literal>session.use_strict_mode</literal> specifies whether the
|
|
module will use strict session id mode. If this mode is enabled,
|
|
the module does not accept uninitialized session ID. If uninitialized
|
|
session ID is sent from browser, new session ID is sent to browser.
|
|
Applications are protected from session fixation via session adoption
|
|
with strict mode.
|
|
Defaults to <literal>0</literal> (disabled).
|
|
</simpara>
|
|
<note>
|
|
<simpara>
|
|
Enabling <literal>session.use_strict_mode</literal> is mandatory for
|
|
general session security. All sites are advised to enable this. See
|
|
<function>session_create_id</function> example code for more details.
|
|
</simpara>
|
|
</note>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry xml:id="ini.session.use-cookies">
|
|
<term>
|
|
<parameter>session.use_cookies</parameter>
|
|
<type>boolean</type>
|
|
</term>
|
|
<listitem>
|
|
<simpara>
|
|
<literal>session.use_cookies</literal> specifies whether the
|
|
module will use cookies to store the session id on the client
|
|
side. Defaults to <literal>1</literal> (enabled).
|
|
</simpara>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry xml:id="ini.session.use-only-cookies">
|
|
<term>
|
|
<parameter>session.use_only_cookies</parameter>
|
|
<type>boolean</type>
|
|
</term>
|
|
<listitem>
|
|
<simpara>
|
|
<literal>session.use_only_cookies</literal> specifies whether
|
|
the module will <emphasis role="strong">only</emphasis> use
|
|
cookies to store the session id on the client side.
|
|
Enabling this setting prevents attacks involved passing session
|
|
ids in URLs.
|
|
Defaults to <literal>1</literal> (enabled) since PHP 5.3.0.
|
|
</simpara>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
|
|
<varlistentry xml:id="ini.session.cookie-lifetime">
|
|
<term>
|
|
<parameter>session.cookie_lifetime</parameter>
|
|
<type>integer</type>
|
|
</term>
|
|
<listitem>
|
|
<simpara>
|
|
<literal>session.cookie_lifetime</literal> specifies the lifetime of
|
|
the cookie in seconds which is sent to the browser. The value 0
|
|
means "until the browser is closed." Defaults to
|
|
<literal>0</literal>. See also
|
|
<function>session_get_cookie_params</function> and
|
|
<function>session_set_cookie_params</function>.
|
|
</simpara>
|
|
<note>
|
|
<simpara>
|
|
The expiration timestamp is set relative to the server time, which is
|
|
not necessarily the same as the time in the client's browser.
|
|
</simpara>
|
|
</note>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry xml:id="ini.session.cookie-path">
|
|
<term>
|
|
<parameter>session.cookie_path</parameter>
|
|
<type>string</type>
|
|
</term>
|
|
<listitem>
|
|
<simpara>
|
|
<literal>session.cookie_path</literal> specifies path to set
|
|
in the session cookie. Defaults to <literal>/</literal>. See also
|
|
<function>session_get_cookie_params</function> and
|
|
<function>session_set_cookie_params</function>.
|
|
</simpara>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry xml:id="ini.session.cookie-domain">
|
|
<term>
|
|
<parameter>session.cookie_domain</parameter>
|
|
<type>string</type>
|
|
</term>
|
|
<listitem>
|
|
<simpara>
|
|
<literal>session.cookie_domain</literal> specifies the domain to
|
|
set in the session cookie. Default is none at all meaning the host name of
|
|
the server which generated the cookie according to cookies specification.
|
|
See also <function>session_get_cookie_params</function> and
|
|
<function>session_set_cookie_params</function>.
|
|
</simpara>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry xml:id="ini.session.cookie-secure">
|
|
<term>
|
|
<parameter>session.cookie_secure</parameter>
|
|
<type>boolean</type>
|
|
</term>
|
|
<listitem>
|
|
<simpara>
|
|
<literal>session.cookie_secure</literal> specifies whether
|
|
cookies should only be sent over secure connections. Defaults to
|
|
<literal>off</literal>.
|
|
See also
|
|
<function>session_get_cookie_params</function> and
|
|
<function>session_set_cookie_params</function>.
|
|
</simpara>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry xml:id="ini.session.cookie-httponly">
|
|
<term>
|
|
<parameter>session.cookie_httponly</parameter>
|
|
<type>boolean</type>
|
|
</term>
|
|
<listitem>
|
|
<simpara>
|
|
Marks the cookie as accessible only through the HTTP protocol. This means
|
|
that the cookie won't be accessible by scripting languages, such as
|
|
JavaScript. This setting can effectively help to reduce identity theft
|
|
through XSS attacks (although it is not supported by all browsers).
|
|
</simpara>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry xml:id="ini.session.cache-limiter">
|
|
<term>
|
|
<parameter>session.cache_limiter</parameter>
|
|
<type>string</type>
|
|
</term>
|
|
<listitem>
|
|
<simpara>
|
|
<literal>session.cache_limiter</literal> specifies the cache
|
|
control method used for session pages.
|
|
It may be one of the following values:
|
|
<literal>nocache</literal>, <literal>private</literal>,
|
|
<literal>private_no_expire</literal>, or <literal>public</literal>.
|
|
Defaults to <literal>nocache</literal>. See also the
|
|
<function>session_cache_limiter</function> documentation for
|
|
information about what these values mean.
|
|
</simpara>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
|
|
<varlistentry xml:id="ini.session.cache-expire">
|
|
<term>
|
|
<parameter>session.cache_expire</parameter>
|
|
<type>integer</type>
|
|
</term>
|
|
<listitem>
|
|
<simpara>
|
|
<literal>session.cache_expire</literal> specifies time-to-live
|
|
for cached session pages in minutes, this has no effect for
|
|
nocache limiter. Defaults to <literal>180</literal>. See also
|
|
<function>session_cache_expire</function>.
|
|
</simpara>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry xml:id="ini.session.use-trans-sid">
|
|
<term>
|
|
<parameter>session.use_trans_sid</parameter>
|
|
<type>boolean</type>
|
|
</term>
|
|
<listitem>
|
|
<simpara>
|
|
<literal>session.use_trans_sid</literal> whether transparent
|
|
sid support is enabled or not. Defaults to
|
|
<literal>0</literal> (disabled).
|
|
</simpara>
|
|
<note>
|
|
<simpara>
|
|
URL based session management has additional security risks
|
|
compared to cookie based session management. Users may send
|
|
a URL that contains an active session ID to their friends by
|
|
email or users may save a URL that contains a session ID to
|
|
their bookmarks and access your site with the same session ID
|
|
always, for example.
|
|
</simpara>
|
|
<simpara>
|
|
Since PHP 7.1.0, full URL path, e.g. https://php.net/, is
|
|
handled by trans sid feature. Previous PHP handled relative
|
|
URL path only. Rewrite target hosts are defined by <link
|
|
linkend="ini.session.trans-sid-hosts">session.trans_sid_hosts</link>.
|
|
</simpara>
|
|
</note>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry xml:id="ini.session.trans-sid-tags">
|
|
<term>
|
|
<parameter>session.trans_sid_tags</parameter>
|
|
<type>string</type>
|
|
</term>
|
|
<listitem>
|
|
<simpara>
|
|
<literal>session.trans_sid_tags</literal> specifies which HTML tags
|
|
are rewritten to include session id when transparent sid support
|
|
is enabled. Defaults to
|
|
<literal>a=href,area=href,frame=src,input=src,form=</literal>
|
|
</simpara>
|
|
<simpara>
|
|
<literal>form</literal> is special tag. <literal><input hidden="session_id" name="session_name"></literal>
|
|
is added as form variable.
|
|
</simpara>
|
|
<note>
|
|
<simpara>
|
|
Before PHP 7.1.0, <link linkend="ini.url-rewriter.tags">url_rewriter.tags</link>
|
|
was used for this purpose. Since PHP 7.1.0, <literal>fieldset</literal>
|
|
is no longer considered as special tag.
|
|
</simpara>
|
|
</note>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry xml:id="ini.session.trans-sid-hosts">
|
|
<term>
|
|
<parameter>session.trans_sid_hosts</parameter>
|
|
<type>string</type>
|
|
</term>
|
|
<listitem>
|
|
<simpara>
|
|
<literal>session.trans_sid_hosts</literal> specifies which hosts
|
|
are rewritten to include session id when transparent sid support
|
|
is enabled. Defaults to <literal>$_SERVER['HTTP_HOST']</literal>
|
|
Multiple hosts can be specified by ",", no space is allowed
|
|
between hosts. e.g. <literal>php.net,wiki.php.net,bugs.php.net</literal>
|
|
</simpara>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry xml:id="ini.session.bug-compat-42">
|
|
<term>
|
|
<parameter>session.bug_compat_42</parameter>
|
|
<type>boolean</type>
|
|
</term>
|
|
<listitem>
|
|
<simpara>
|
|
PHP versions 4.2.3 and lower have an undocumented feature/bug that
|
|
allows you to initialize a session variable in the global scope,
|
|
albeit <link linkend="ini.register-globals">register_globals</link>
|
|
is disabled. PHP 4.3.0 and later will warn you, if this feature is
|
|
used, and if <link linkend="ini.session.bug-compat-warn">
|
|
session.bug_compat_warn</link> is also enabled. This feature/bug can be
|
|
disabled by disabling this directive.
|
|
</simpara>
|
|
<note>
|
|
<simpara>
|
|
Removed in PHP 5.4.0.
|
|
</simpara>
|
|
</note>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry xml:id="ini.session.bug-compat-warn">
|
|
<term>
|
|
<parameter>session.bug_compat_warn</parameter>
|
|
<type>boolean</type>
|
|
</term>
|
|
<listitem>
|
|
<simpara>
|
|
PHP versions 4.2.3 and lower have an undocumented feature/bug that
|
|
allows you to initialize a session variable in the global scope,
|
|
albeit <link linkend="ini.register-globals">register_globals</link>
|
|
is disabled. PHP 4.3.0 and later will warn you, if this feature is
|
|
used by enabling both
|
|
<link linkend="ini.session.bug-compat-42">session.bug_compat_42</link>
|
|
and <link linkend="ini.session.bug-compat-warn">
|
|
session.bug_compat_warn</link>.
|
|
</simpara>
|
|
<note>
|
|
<simpara>
|
|
Removed in PHP 5.4.0.
|
|
</simpara>
|
|
</note>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry xml:id="ini.session.sid-length">
|
|
<term>
|
|
<parameter>session.sid_length</parameter>
|
|
<type>integer</type>
|
|
</term>
|
|
<listitem>
|
|
<simpara>
|
|
<literal>session.sid_length</literal> allows you to specify the
|
|
length of session ID string. Session ID length can be between 22
|
|
to 256.
|
|
</simpara>
|
|
<simpara>
|
|
The default is 32. If you need compatibility you may specify 32,
|
|
40, etc. Longer session ID is harder to guess. At least 32 chars
|
|
is recommended.
|
|
</simpara>
|
|
<para>
|
|
Compatibility Note: Use 32 for
|
|
<literal>session.hash_func</literal>=0 (MD5) and
|
|
<literal>session.hash_bits_per_character</literal>=4,
|
|
<literal>session.hash_func</literal>=1 (SHA1) and
|
|
<literal>session.hash_bits_per_character</literal>=6. Use 26 for
|
|
<literal>session.hash_func</literal>=0 (MD5) and
|
|
<literal>session.hash_bits_per_character</literal>=5. Use 22 for
|
|
<literal>session.hash_func</literal>=0 (MD5) and
|
|
<literal>session.hash_bits_per_character</literal>=6. You must
|
|
configure INI values to have at least 128 bits in session ID. Do
|
|
not forget set appropriate value to
|
|
<literal>session.sid_bits_per_character</literal>, otherwise you
|
|
will have weaker session ID.
|
|
</para>
|
|
<note>
|
|
<simpara>
|
|
This setting is introduced in PHP 7.1.0.
|
|
</simpara>
|
|
</note>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry xml:id="ini.session.sid-bits-per-character">
|
|
<term>
|
|
<parameter>session.sid_bits_per_character</parameter>
|
|
<type>integer</type>
|
|
</term>
|
|
<listitem>
|
|
<simpara>
|
|
<literal>session.sid_per_character</literal> allows you to specify the
|
|
number of bits in encoded session ID character. The possible values are
|
|
'4' (0-9, a-f), '5' (0-9, a-v), and '6' (0-9, a-z, A-Z, "-", ",").
|
|
</simpara>
|
|
<simpara>
|
|
The default is 4. The more bits results in stronger session ID. 5 is
|
|
recommended value for most environments.
|
|
</simpara>
|
|
<para>
|
|
</para>
|
|
<note>
|
|
<simpara>
|
|
This setting is introduced in PHP 7.1.0.
|
|
</simpara>
|
|
</note>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry xml:id="ini.session.hash-function">
|
|
<term>
|
|
<parameter>session.hash_function</parameter>
|
|
<type>mixed</type>
|
|
</term>
|
|
<listitem>
|
|
<simpara>
|
|
<literal>session.hash_function</literal> allows you to specify the hash
|
|
algorithm used to generate the session IDs. '0' means MD5 (128 bits) and
|
|
'1' means SHA-1 (160 bits).
|
|
</simpara>
|
|
<para>
|
|
Since PHP 5.3.0 it is also possible to specify any of the algorithms
|
|
provided by the <link linkend="ref.hash">hash extension</link> (if it is
|
|
available), like <literal>sha512</literal> or
|
|
<literal>whirlpool</literal>. A complete list of supported algorithms can
|
|
be obtained with the <function>hash_algos</function> function.
|
|
</para>
|
|
<note>
|
|
<simpara>
|
|
This setting was introduced in PHP 5. Removed in PHP 7.1.0.
|
|
</simpara>
|
|
</note>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry xml:id="ini.session.hash-bits-per-character">
|
|
<term>
|
|
<parameter>session.hash_bits_per_character</parameter>
|
|
<type>integer</type>
|
|
</term>
|
|
<listitem>
|
|
<simpara>
|
|
<literal>session.hash_bits_per_character</literal> allows you to define
|
|
how many bits are stored in each character when converting the binary
|
|
hash data to something readable. The possible values are '4' (0-9, a-f),
|
|
'5' (0-9, a-v), and '6' (0-9, a-z, A-Z, "-", ",").
|
|
</simpara>
|
|
<note>
|
|
<simpara>
|
|
Removed in PHP 7.1.0.
|
|
</simpara>
|
|
</note>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry xml:id="ini.session.upload-progress.enabled">
|
|
<term>
|
|
<parameter>session.upload_progress.enabled</parameter>
|
|
<type>boolean</type>
|
|
</term>
|
|
<listitem>
|
|
<simpara>
|
|
Enables upload progress tracking, populating the <varname>$_SESSION</varname> variable.
|
|
Defaults to 1, enabled.
|
|
</simpara>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry xml:id="ini.session.upload-progress.cleanup">
|
|
<term>
|
|
<parameter>session.upload_progress.cleanup</parameter>
|
|
<type>boolean</type>
|
|
</term>
|
|
<listitem>
|
|
<simpara>
|
|
Cleanup the progress information as soon as all POST data has been read
|
|
(i.e. upload completed). Defaults to 1, enabled.
|
|
</simpara>
|
|
<note>
|
|
<simpara>
|
|
It is highly recommended to keep this feature enabled.
|
|
</simpara>
|
|
</note>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry xml:id="ini.session.upload-progress.prefix">
|
|
<term>
|
|
<parameter>session.upload_progress.prefix</parameter>
|
|
<type>string</type>
|
|
</term>
|
|
<listitem>
|
|
<simpara>
|
|
A prefix used for the upload progress key in the <varname>$_SESSION</varname>.
|
|
This key will be concatenated with the value of
|
|
<literal>$_POST[ini_get("session.upload_progress.name")]</literal> to
|
|
provide a unique index.
|
|
</simpara>
|
|
<simpara>
|
|
Defaults to "upload_progress_".
|
|
</simpara>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry xml:id="ini.session.upload-progress.name">
|
|
<term>
|
|
<parameter>session.upload_progress.name</parameter>
|
|
<type>string</type>
|
|
</term>
|
|
<listitem>
|
|
<simpara>
|
|
The name of the key to be used in <varname>$_SESSION</varname> storing
|
|
the progress information. See also
|
|
<link linkend="ini.session.upload-progress.prefix">session.upload_progress.prefix</link>.
|
|
</simpara>
|
|
<simpara>
|
|
If <literal>$_POST[ini_get("session.upload_progress.name")]</literal>
|
|
is not passed or available, upload progressing will not be recorded.
|
|
</simpara>
|
|
<simpara>
|
|
Defaults to "PHP_SESSION_UPLOAD_PROGRESS".
|
|
</simpara>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry xml:id="ini.session.upload-progress.freq">
|
|
<term>
|
|
<parameter>session.upload_progress.freq</parameter>
|
|
<type>mixed</type>
|
|
</term>
|
|
<listitem>
|
|
<simpara>
|
|
Defines how often the upload progress information should be updated.
|
|
This can be defined in bytes (i.e. "update progress information after every 100 bytes"), or in percentages (i.e. "update progress information after receiving every 1% of the whole filesize").
|
|
</simpara>
|
|
<simpara>
|
|
Defaults to "1%".
|
|
</simpara>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry xml:id="ini.session.upload-progress.min-freq">
|
|
<term>
|
|
<parameter>session.upload_progress.min_freq</parameter>
|
|
<type>integer</type>
|
|
</term>
|
|
<listitem>
|
|
<simpara>
|
|
The minimum delay between updates, in seconds.
|
|
Defaults to "1" (one second).
|
|
</simpara>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry xml:id="ini.session.lazy-write">
|
|
<term>
|
|
<parameter>session.lazy_write</parameter>
|
|
<type>boolean</type>
|
|
</term>
|
|
<listitem>
|
|
<simpara>
|
|
<literal>session.lazy_write</literal>, when set to 1, means that session
|
|
data is only rewritten if it changes. Defaults to 1, enabled.
|
|
</simpara>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
</variablelist>
|
|
</para>
|
|
|
|
<para>
|
|
The
|
|
<link
|
|
linkend="ini.register-globals"><literal>register_globals</literal></link>
|
|
configuration settings influence how the session variables get
|
|
stored and restored.
|
|
</para>
|
|
|
|
<para>
|
|
Upload progress will not be registered unless
|
|
session.upload_progress.enabled is enabled, and the
|
|
$_POST[ini_get("session.upload_progress.name")] variable is set.
|
|
See <link linkend="session.upload-progress">Session Upload Progress</link> for more details on this functionality.
|
|
</para>
|
|
|
|
</section>
|
|
|
|
<!-- Keep this comment at the end of the file
|
|
Local variables:
|
|
mode: sgml
|
|
sgml-omittag:t
|
|
sgml-shorttag:t
|
|
sgml-minimize-attributes:nil
|
|
sgml-always-quote-attributes:t
|
|
sgml-indent-step:1
|
|
sgml-indent-data:t
|
|
indent-tabs-mode:nil
|
|
sgml-parent-document:nil
|
|
sgml-default-dtd-file:"~/.phpdoc/manual.ced"
|
|
sgml-exposed-tags:nil
|
|
sgml-local-catalogs:nil
|
|
sgml-local-ecat-files:nil
|
|
End:
|
|
vim600: syn=xml fen fdm=syntax fdl=2 si
|
|
vim: et tw=78 syn=sgml
|
|
vi: ts=1 sw=1
|
|
-->
|