mark/telvero_whatson_talpa
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

FIX: Login

Browse Source
This commit is contained in:
Mark Pinkster 2026-03-12 18:55:32 +01:00
parent 341a113463
commit 20975f3c87
2 changed files with 23 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
auth/auth_functions.php
View File

@ -9,7 +9,27 @@ if (session_status() === PHP_SESSION_NONE) {
ini_set('session.cookie_httponly', 1);
ini_set('session.use_strict_mode', 1);
ini_set('session.cookie_samesite', 'Lax');
// Set Secure flag when served over HTTPS (also handles reverse proxies)
$isHttps = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off')
|| (!empty($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https')
|| (!empty($_SERVER['HTTP_X_FORWARDED_SSL']) && $_SERVER['HTTP_X_FORWARDED_SSL'] === 'on');
ini_set('session.cookie_secure', $isHttps ? 1 : 0);
// Determine if this is the login page (the only page allowed to create a new session cookie)
$isLoginPage = (strpos($_SERVER['SCRIPT_NAME'] ?? '', '/auth/login.php') !== false);
if (!isset($_COOKIE[session_name()]) && !$isLoginPage) {
// No existing session cookie and not the login page:
// Start session without sending a Set-Cookie header to prevent
// sub-resource requests (favicon.ico, robots.txt, etc.) from
// overwriting the valid session cookie in the browser.
// With use_cookies=0 and use_only_cookies=1 (default), PHP starts
// a session but sends no Set-Cookie header.
ini_set('session.use_cookies', 0);
session_start();
} else {
session_start();
}
}
/**

2
robots.txt Normal file
View File

@ -0,0 +1,2 @@
User-agent: *
Disallow: /