From 83b8bc38ebaaf0bee3a735a4d6c33fff6004c30a Mon Sep 17 00:00:00 2001
From: Casey Peel <cpeel@users.noreply.github.com>
Date: Fri, 16 Oct 2026 15:20:40 -0700
Subject: [PATCH] Only set session cookies on login

Be stingy with our session cookies and only set them on successful
login rather than just with a page request. This improves our ability
to shortcut code for crawlers that retain cookies.
---
 pinc/dpsession.inc | 49 ++++++++++++++++++++++++----------------------
 1 file changed, 26 insertions(+), 23 deletions(-)

diff --git a/pinc/dpsession.inc b/pinc/dpsession.inc
index b7bcf6cd1..9650760d8 100644
--- a/pinc/dpsession.inc
+++ b/pinc/dpsession.inc
@@ -36,17 +36,31 @@ function dpsession_begin(string $userID): void
  * Resume a session, if one exists.
  *
  * If the request claimed to belong to a session, and that session is
- * valid/current/non-expired, then refresh the session, reinstate the
- * global variable ($pguser) of that session, and return TRUE.
- * Otherwise, return FALSE.
+ * valid/current/non-expired, then refresh the session, and reinstate the
+ * global variable ($pguser) of that session.
  */
 function dpsession_resume(): void
 {
     global $cookie_lifetime, $pguser, $session_name;
 
+    // If there's no cookie they can't be logged in and there's nothing
+    // to resume and don't bother sending them a session cookie.
+    if (!dpsession_is_cookie_set()) {
+        // If this is the first time in this browsing session that they're
+        // hitting the site, we grab the request's http_referer (if any),
+        // and stash that in a cookie for later use in case they register
+        // in this browsing session.
+        if (!isset($_COOKIE["http_referer"]) && $referer = $_SERVER["HTTP_REFERER"] ?? '') {
+            dp_setcookie('http_referer', $referer);
+        }
+
+        return;
+    }
+
     _session_set_handlers_and_start();
 
-    if (isset($_SESSION['pguser']) && !empty($_SESSION['pguser'])) {
+    // If it's a valid session, refresh the cookie and update user activity
+    if (!empty($_SESSION['pguser'] ?? '')) {
         // Refresh the cookie
         if (($id = session_id()) !== false) {
             dp_setcookie($session_name, $id, time() + $cookie_lifetime);
@@ -54,27 +68,10 @@ function dpsession_resume(): void
 
         // set global variable $pguser
         $pguser = $_SESSION['pguser'];
-        $user_is_logged_in = true;
-    } else {
-        session_unset();
-        session_destroy();
-        $user_is_logged_in = false;
-    }
 
-    if ($user_is_logged_in) {
         _update_user_activity_time(false);
-    }
-
-    // If the sender isn't logged in, and this is the first time in this
-    // browsing session that they're hitting the site, we grab the request's
-    // http_referer (if any), and stash that in a cookie for later use, in
-    // case they register in this browsing session.
-    if (!$user_is_logged_in && !isset($_COOKIE["http_referer"])) {
-        if (isset($_SERVER["HTTP_REFERER"])) {
-            dp_setcookie('http_referer', $_SERVER["HTTP_REFERER"]);
-        } else {
-            dp_setcookie('http_referer', '');
-        }
+    } else {
+        dpsession_end();
     }
 }
 
@@ -255,6 +252,12 @@ class DPSessionHandler implements SessionHandlerInterface
     }
 }
 
+/*
+ * Start PHP session management.
+ *
+ * This will create the session handler and start the session which will
+ * create a session in the DB and send the user a session cookie.
+ */
 function _session_set_handlers_and_start(): void
 {
     static $session_handler = null;