new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

session_management/php

3 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

PHP session security configuration

Set session.save_path = /path/PHP-session/, session.name = myPHPSESSID (change to a custom value), session.auto_start = Off, session.use_trans_sid = 0, session.cookie_domain = full.qualified.domain.name, session.cookie_path = /application/path/, session.use_strict_mode = 1, session.use_cookies = 1, session.use_only_cookies = 1, session.cookie_lifetime = 14400 (4 hours), session.cookie_secure = 1, session.cookie_httponly = 1, session.cookie_samesite = Strict, session.cache_expire = 30, session.sid_length = 256, session.sid_bits_per_character = 6.

PHP session name should be customized

It is a good practice to change session.name from the default to a custom value to make session identification less predictable.

PHP session cookie SameSite attribute strict mode

Set session.cookie_samesite = Strict to protect against CSRF attacks by restricting cookie transmission to same-site requests only.

Give your agent this brain