In a Drupal 7 site taken over from an ex-colleague, sessions for anonymous user always are generated as this screenshot shows.


The security-scanning service provider always claims:

Our company also observed that the application sets the SSESSd84a1fe63b666c4294afc5029aa95bfd cookie prior to authentication and it doesn't update the value of the session cookie even after authentication but, as the user is not able to fix the session by updating the cookie, it was not reported as a separate finding.

I'm a novice Drupaler. I installed a new Drupal 7 site from scratch, and there isn't a session cookie, but there is one in Drupal.org. I also checked contributed modules in my site, disabled the most suspicious 2 modules (login_destination and betterlogin), still no luck. I added a line "ini_set('session.cookie_lifetime', 0);" in settings.php file, no luck again. I don't know how to do next.

  • Does your site have a shopping cart?
    – No Sssweat
    Commented Oct 30, 2019 at 12:03
  • No, no commerce related features.
    – Vincent
    Commented Oct 30, 2019 at 13:06
  • IIRC, session in Drupal 7 are create when needed, so I think there is a module installed that may need session data.
    – mpdonadio
    Commented Oct 31, 2019 at 2:20
  • Thank you for your tip! But how to know which module need session data? To call which PHP built-in function or Drupal core function? Then I can search and find it.
    – Vincent
    Commented Nov 1, 2019 at 0:35


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.