LS 3 is creating two session cookies.
Code:
Name PHPSESSID (taken from php.ini)
Value 11c93...(etc.)
Host host.domain.tld
Path /
Expires At end of session
Secure Yes
HttpOnly Yes
Name YII_CSRF_TOKEN
Name YII_CSRF_TOKEN
Value SlBXd....(etc.)
Host host.domain.tld
Path /
Expires At end of session
Secure Yes
HttpOnly No
Issues around sessions with multiple installations (can be your own space or on shared server with shared session storage) can be the result of the current behavior.
Wouldn't it be better to change the default behavior?
1. Recognize the path and set the path in the cookie.
LS is ignoring the path. If you have two installations in different paths, the cookies are the same.
You cannot stay logged in both LS installations.
2. Set a session-name (not using the default name)
secure.php.net/manual/en/session.configu...php#ini.session.name
3. Add a unique part (for every installation) to the names.
Example Nextcloud:
Code:
Name nc_sameSiteCookielax
Value true
Host host.domain.tld
Path /yourinstallation
Expires Fri, 31 Dec 2100 23:59:59 GMT
Secure Yes
HttpOnly Yes
Name nc_sameSiteCookiestrict
Value true
Host host.domain.tld
Path /yourinstallation
Expires Fri, 31 Dec 2100 23:59:59 GMT
Secure Yes
HttpOnly Yes
Name oc3d172roqs9 (unique name)
Value 68899..(etc.)
Host host.domain.tld
Path /yourinstallation
Expires At end of session
Secure Yes
HttpOnly Yes
Topic Author
