[VOTE] Secure Session Configuration Defaults

On 5/3/26 08:08, Jorg Sowa wrote:

Under the References section of the RFC, would you mind providing a link to the relevant mailing list discussion? I can't find the discussion, and I'd like to see what others have said about the proposal. I would consider this an editorial change, so it shouldn't affect the voting timeline (i.e., you don't need to stop the vote and restart it). According to the voting procedure rules, your voting announcement email must also include a link to the discussion thread. Again, simply replying here with the link should suffice. https://github.com/php/policies/blob/main/feature-proposals.rst#voting-procedure Cheers, Ben

Hi Jorg, The votes must also contain an "Abstain" option. Thank you, Ayesh.

Hello internals, The voting has been closed. All changes have been accepted with the following results: - Change session.use_strict_mode default to 1 -> 27 Yes, 0 No, 0 Abstain - Change session.cookie_httponly default to 1 -> 26 Yes, 0 No, 1 Abstain - Change session.cookie_samesite default to La -> 26 Yes, 0 No, 0 Abstain Thank you very much for participation. Kind regards, Jorg