- List new session.use_only_cookies option.

Author: mfn

php.ini-dist

@@ -725,6 +725,9 @@ session.save_path = /tmp
 ; Whether to use cookies.
 session.use_cookies = 1
 
+; This option enables administrators to make their users invulnerable to
+; attacks which involve passing session ids in URLs; defaults to 0.
+; session.use_only_cookies = 1
 
 ; Name of the session (used as cookie name).
 session.name = PHPSESSID

php.ini-recommended

@@ -732,6 +732,9 @@ session.save_path = /tmp
 ; Whether to use cookies.
 session.use_cookies = 1
 
+; This option enables administrators to make their users invulnerable to 
+; attacks which involve passing session ids in URLs; defaults to 0.
+; session.use_only_cookies = 1
 
 ; Name of the session (used as cookie name).
 session.name = PHPSESSID