Cookies that mean "this request belongs to a session".
SESS over HTTP and SSESS over HTTPS, then exactly 32 lowercase hex characters.
Read off the source; the first version of this was written from memory and was wrong in a way
that mattered. SessionConfiguration::getName() is
($request->isSecure() ? 'SSESS' : 'SESS') . $this->getUnprefixedName($request)
(drupal-src/core/lib/Drupal/Core/Session/SessionConfiguration.php:79), and
getUnprefixedName() ends return substr(hash('sha256', $session_name), 0, 32); at line 109 --
outside its if/elseif/else, so all three branches hash. The test-user-agent branch and the
cookie_domain branch produce 32 hex characters too. There is no unhashed form to be lenient
about.
The loose pattern that assumed otherwise matched SESSION=, which is a common cookie name in
other frameworks. Every request carrying one would have been charged as authenticated and
rendered, which destroys the allowance this module exists to enforce rather than protecting it.
The safety argument that motivated the looseness is real but belongs elsewhere: an authenticated
response must never reach the shared anonymous cache -- this project shipped that once, a render
that kept uid 1 landing in the anonymous page cache at 90,038 bytes against 12,296. That is
enforced STRUCTURALLY in src/site.ts, which refuses to cache when the request was authenticated
or the response carries Set-Cookie, so it does not depend on this pattern being perfect.
Cookies that mean "this request belongs to a session".
SESSover HTTP andSSESSover HTTPS, then exactly 32 lowercase hex characters.Read off the source; the first version of this was written from memory and was wrong in a way that mattered.
SessionConfiguration::getName()is($request->isSecure() ? 'SSESS' : 'SESS') . $this->getUnprefixedName($request)(drupal-src/core/lib/Drupal/Core/Session/SessionConfiguration.php:79), andgetUnprefixedName()endsreturn substr(hash('sha256', $session_name), 0, 32);at line 109 -- outside its if/elseif/else, so all three branches hash. The test-user-agent branch and thecookie_domainbranch produce 32 hex characters too. There is no unhashed form to be lenient about.The loose pattern that assumed otherwise matched
SESSION=, which is a common cookie name in other frameworks. Every request carrying one would have been charged as authenticated and rendered, which destroys the allowance this module exists to enforce rather than protecting it.The safety argument that motivated the looseness is real but belongs elsewhere: an authenticated response must never reach the shared anonymous cache -- this project shipped that once, a render that kept uid 1 landing in the anonymous page cache at 90,038 bytes against 12,296. That is enforced STRUCTURALLY in
src/site.ts, which refuses to cache when the request was authenticated or the response carriesSet-Cookie, so it does not depend on this pattern being perfect.