PHP 8.6 changes the default value of three session INI settings. The accepted secure session defaults RFC, written by Jorg Sowa, enables session.use_strict_mode and session.cookie_httponly. It also sets session.cookie_samesite to Lax.
Here is the before and after:
| Setting | Was | Now |
|---|---|---|
session.use_strict_mode |
0 |
1 |
session.cookie_httponly |
0 |
1 |
session.cookie_samesite |
unset | "Lax" |
These are default values, so they apply only when an app, framework, or php.ini file does not override them. Applications that already set all three values will keep their current behavior.
SameSite Lax Changes Cross-Site Requests
With session.cookie_samesite set to Lax, the browser stops sending the session cookie on cross-site requests except top-level navigations that use a safe HTTP method. A cross-site POST no longer carries the session.
This can affect payment services and identity providers that send users back with a cross-site POST. The returning request will not include the session cookie, so the app may treat the user as logged out or lose access to state stored under that session. Content loaded in an iframe on another site can face the same limit.
If you need the old behavior, you have to say so:
session.cookie_samesite = "None" session.cookie_secure = 1
Modern browsers require cookies marked SameSite=None to also use the Secure flag. The two settings should be changed together.
HttpOnly Hides the Session ID From JavaScript
With session.cookie_httponly set to 1, JavaScript cannot read the session cookie through document.cookie. This makes it harder for an injected script to steal the session ID. The browser still sends the cookie with matching requests.
This can break front-end code that reads the session ID from the cookie and places it in a request header. It may also affect older single sign-on code that passes the ID to another script. PHP recommends using a separate client-readable token when the browser needs one.
Applications that cannot move away from JavaScript access yet can keep the old behavior with session.cookie_httponly = 0.
Strict Mode Rejects Session IDs It Never Issued
With session.use_strict_mode set to 1, PHP rejects an unknown session ID and creates a new one. This helps prevent session fixation, where an attacker gives a victim a known session ID and waits for the victim to sign in.
Custom session handlers need a closer look. A handler that accepts outside session IDs without a matching storage entry may behave differently under strict mode. Such handlers should implement validateId() and create_sid(), or keep session.use_strict_mode = 0 until they are updated.
The RFC notes that common Redis and Memcached session handlers are unaffected because they accept IDs through their fallback behavior.
Empty Sessions and Lazy Writes
PHP 8.6 also changes how empty sessions work with custom handlers. This change is listed in php-src's upgrade notes, not the session-defaults RFC.
When session.lazy_write is enabled and a handler implements SessionUpdateTimestampHandlerInterface, a session that starts and remains empty now calls updateTimestamp() instead of write().
Earlier PHP versions returned false from session_encode() for an empty session. PHP 8.6 returns an empty string and uses false only when encoding fails.
If a custom handler uses write() with empty data to remove a session, it may need the same logic in updateTimestamp().
How to Check Your App
Run the test suite on a PHP 8.6 beta build without overriding these session settings. Check flows where a request that once arrived with a session now arrives as a guest. Payment callbacks, SSO responses, and embedded pages deserve extra attention.
Then check the three settings in production the same way, by grepping for them rather than assuming:
php -i | grep '^session.cookie_samesite\|^session.cookie_httponly\|^session.use_strict_mode'
Compare the results with the application's intended settings. Test any change before deploying PHP 8.6.
The Vote
PHP contributors voted on each default separately. Strict mode passed 27-0, HttpOnly passed with 26 votes and one abstention, and SameSite Lax passed 26-0. All three changes target PHP 8.6.
Read More
The secure session defaults RFC explains the reasons for each change. The php-src UPGRADING file covers the lazy-write change and other upgrade notes. For more PHP 8.6 coverage, see the feature roundup and the confirmed PHP 8.6 tag.
