0

In a Drupal 7 site taken over from an ex-colleague, sessions for anonymous user always are generated as this screenshot shows.

screenshot

The security-scanning service provider always claims:

Our company also observed that the application sets the SSESSd84a1fe63b666c4294afc5029aa95bfd cookie prior to authentication and it doesn't update the value of the session cookie even after authentication but, as the user is not able to fix the session by updating the cookie, it was not reported as a separate finding.

I'm a novice Drupaler. I installed a new Drupal 7 site from scratch, and there isn't a session cookie, but there is one in Drupal.org. I also checked contributed modules in my site, disabled the most suspicious 2 modules (login_destination and betterlogin), still no luck. I added a line "ini_set('session.cookie_lifetime', 0);" in settings.php file, no luck again. I don't know how to do next.

  • Does your site have a shopping cart? – No Sssweat Oct 30 at 12:03
  • No, no commerce related features. – Vincent Oct 30 at 13:06
  • IIRC, session in Drupal 7 are create when needed, so I think there is a module installed that may need session data. – mpdonadio Oct 31 at 2:20
  • Thank you for your tip! But how to know which module need session data? To call which PHP built-in function or Drupal core function? Then I can search and find it. – Vincent Nov 1 at 0:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.