Human rights and privacy organizations (we've heard specifically from one well-known one) will not be able to deploy Drupal 7 without hacking core, since it leaves persistent cookies for a variety of cookies.

To make Drupal more respectful of end-user privacy and anonimity, we should at least add an opaque variable that toggles all cookies to be set with a 0 lifetime, so that's they will not persist past the current browser session.

CommentFileSizeAuthor
#1 969026-session-cookies-switch-1.patch4.13 KBpwolanin

Comments

pwolanin’s picture

pwolanin commented
Status: Active » Needs review
StatusFileSize
new 969026-session-cookies-switch-1.patch4.13 KB

Here's a quick starter patch - not sure I found everything. We need to set a JS setting since cookies may be set via JS or PHP.

mtndan’s picture

mtndan commented

Peter, any update on this patch? We have a similar requirement at the fed level and cannot use persistent cookies. Thank you.

anavarre’s picture

anavarre
Primary language French
Location 🇪🇺
commented

Subscribe

pwolanin’s picture

pwolanin commented
Version: 7.x-dev » 8.x-dev
Issue tags: +Needs backport to D7

At this point we'll need to make sure it applies to 8.x

yesct’s picture

yesct commented
Issue tags: -Needs backport to D7

#1: 969026-session-cookies-switch-1.patch queued for re-testing.

Status: Needs review » Needs work
Issue tags: +Needs backport to D7

The last submitted patch, 969026-session-cookies-switch-1.patch, failed testing.

star-szr’s picture

star-szr
he/him
Primary language English
commented
Issue tags: +Novice, +Needs reroll

Tagging, the patch in #1 needs to be re-rolled for 8.x and core/. Re-rolling instructions.

noels’s picture

noels commented
Status: Needs work » Closed (works as designed)

This patch does not need to be re-rolled for D8. D8 already supports session only cookies. If you need session only cookies, you need to ensure that lifetime parameter returned by session_get_cookie_params is unset.

deekayen’s picture

deekayen commented
Issue tags: -Novice, -Needs reroll

cleaning up tags