0

In a Drupal 7 site taken over from an ex-colleague, sessions for anonymous user always are generated as this screenshot shows.

screenshot

The security-scanning service provider always claims:

Our company also observed that the application sets the SSESSd84a1fe63b666c4294afc5029aa95bfd cookie prior to authentication and it doesn't update the value of the session cookie even after authentication but, as the user is not able to fix the session by updating the cookie, it was not reported as a separate finding.

I'm a novice Drupaler. I installed a new Drupal 7 site from scratch, and there isn't a session cookie, but there is one in Drupal.org. I also checked contributed modules in my site, disabled the most suspicious 2 modules (login_destination and betterlogin), still no luck. I added a line "ini_set('session.cookie_lifetime', 0);" in settings.php file, no luck again. I don't know how to do next.

Improve this question
4
  • Does your site have a shopping cart?
    – No Sssweat
    Oct 30, 2019 at 12:03
  • No, no commerce related features.
    – Vincent
    Oct 30, 2019 at 13:06
  • IIRC, session in Drupal 7 are create when needed, so I think there is a module installed that may need session data.
    – mpdonadio ♦
    Oct 31, 2019 at 2:20
  • Thank you for your tip! But how to know which module need session data? To call which PHP built-in function or Drupal core function? Then I can search and find it.
    – Vincent
    Nov 1, 2019 at 0:35

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.