closing security gap [ignore guarding change for now]

2026-05-07 10:29:14 +07:00
parent a24930f684
commit a75d37e841
13 changed files with 39 additions and 93 deletions
@@ -1,6 +1,10 @@
 <?php
 // app/session.php
 if (session_status() === PHP_SESSION_NONE) {
+    // Reject client-supplied session IDs — prevents session fixation.
+    ini_set('session.use_strict_mode', 1);
+    // Server-side session file lifetime: 1 hour.
+    ini_set('session.gc_maxlifetime', 3600);
    session_set_cookie_params([
        'lifetime' => 0,
        'path'     => '/wms/',