Repository navigation
Conversation
sso.php calls session_start() before it requires config.php, but
config.php applies the session hardening first and only then starts
the session itself:
ini_set('session.cookie_httponly', true);
ini_set('session.use_strict_mode', 1);
ini_set('session.use_only_cookies', 1);
ini_set('session.cookie_lifetime', $config['SESSION_EXPIRY']);
PHP refuses to change session ini settings while a session is active,
so on the SSO entry point all four calls fail with
Warning: ini_set(): Session ini settings cannot be changed when a
session is active
and the cookie is issued with php.ini defaults instead. With a stock
php.ini that means no HttpOnly flag, no strict mode and no expiry.
PHP does not resend the session cookie on later requests, so the
weaker cookie stays in use for the whole session.
config.php starts the session right after these settings, so the
early call is not needed. Removing it makes sso.php behave like
index.php.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the bug reported in #501 (closed, but still present on master). Follow-up to #500.
sso.phpcallssession_start()beforerequire_once("config.php"). Since 7cdb016 (2017), config.php applies the session hardening (cookie_httponly,use_strict_mode,use_only_cookies,cookie_lifetime = SESSION_EXPIRY) and then starts the session itself. On the SSO entry point the session is already active by then, so PHP rejects all fourini_set()calls and the cookie falls back to php.ini defaults.This is broader than #501 described: besides
SESSION_EXPIRY, sessions created via SSO also lose the HttpOnly flag and strict mode.Before (
GET /sso.phpwithout a cookie), plus 4ini_set()warnings per request:After, identical to
GET /:The fix drops the early
session_start(); config.php starts the session right after the ini settings, as on theindex.phppath. Thenew Session()/Registry::set()lines further down are now redundant but harmless since #500, so I left them to keep the diff minimal. Visible change for SSO users: their session cookie now expires afterSESSION_EXPIRY, like for form logins.Tested on piler 1.4.9 / PHP 8.5 / nginx by comparing the
Set-Cookieheaders of/sso.phpand/before and after the change. I don't have NTLM configured, so the SSO login itself was not exercised; the change only touches code that runs before authentication.