Repository navigation
Only set session cookies on login - #1691
Merged
Merged
Conversation
bpfoley
reviewed
Oct 17, 2026
| _session_set_handlers_and_start(); | ||
|
|
||
| // If it's a valid session, refresh the cookie and update user activity | ||
| if (isset($_SESSION['pguser']) && !empty($_SESSION['pguser'])) { |
Collaborator
There was a problem hiding this comment.
You could use the same trick here. (I'm mostly suggesting this because string literals are fragile. They're easy to mistype.
if (!empty($_SESSION['pguser'] ?? '')) { ... }
bpfoley
approved these changes
Oct 17, 2026
| // in this browsing session. | ||
| if (!isset($_COOKIE["http_referer"])) { | ||
| if (isset($_SERVER["HTTP_REFERER"])) { | ||
| dp_setcookie('http_referer', $_SERVER["HTTP_REFERER"]); |
Collaborator
There was a problem hiding this comment.
You could simplify this to
dp_setcookie('http_referer', $_SERVER['HTTP_REFERER'] ?? '');(and just to remind the reader that setting the cookie to the empty string clears it, you could add an 'otherwise clear it' to the comment)
Member
Author
There was a problem hiding this comment.
I decided we shouldn't be sending a delete cookie everytime someone accesses a page without a referer header, so I've modified this code a bit differently.
Be stingy with our session cookies and only set them on successful login rather than just with a page request. This improves our ability to shortcut code for crawlers that retain cookies.
bpfoley
approved these changes
Oct 19, 2026
srjfoo
approved these changes
Oct 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Be stingy with our session cookies and only set them on successful login rather than just with a page request. This improves our ability to shortcut code for crawlers that retain cookies.
No functional changes for authenticated users: users are still able to authenticate and get cookies and everything still works. Unauthenticated users no longer get cookies.
Compare:
Sandbox: https://www.pgdp.org/~cpeel/c.branch/stingy-cookies