I recently found the following configuration settings:
and I have some questions about them:
Use-strict-mode says the following:
session.use_strict_mode specifies whether the module will use strict session id mode. If this mode is enabled, the module does not accept uninitialized session ID. If uninitialized session ID is sent from browser, new session ID is sent to browser. Applications are protected from session fixation via session adoption with strict mode. Defaults to 0 (disabled).
My rudimentary understanding is that it creates always a session ID for you, but I already saw another config option with does the same. So I assume that my understanding is wrong. So why do we need it? (The closest I saw is that it prevents OWASP A9, but it does not give me a lot of information)
allows you to define how many bits are stored in each character when converting the binary hash data to something readable. The possible values are '4' (0-9, a-f), '5' (0-9, a-v), and '6' (0-9, a-z, A-Z, "-", ",").
From my understanding this does not contribute anything to security, only tells what chars can be used for your session. The bigger the number - more characters and thus smaller string. So why not to put
6 (instead of default
This one is clear, but from the big list of possible functions, which is the one (I assume that default
md5 is not good) is preferable?
P.S. before asking the question, I read this answer.