The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.Hi,
I've built a system around Webforms that relies on the use of the SESSION variable to pass data in and out of the webform (and on into rules, conversion tracking and many other things), however I have just discovered that session tokens are disabled for anonymous users due to a previous issue with Drupal's cache system.
I have read through a number of related issues and forum posts that have covered this problem: #653396: No %cookie or %session for anonymous anymore, #934572: Session variables on webform and #653396: No %cookie or %session for anonymous anymore, where a feature request to allow anonymous users to see their own submissions resulted in cache being selectively disabled where anonymous acccess to submissions was granted. However, it was ended with this comment:
I did not include the change to the %session variable handling, as it was not related to the topic of the issue.
I think this is a pity as there have already been 3 issues requesting this feature, and there is also this forum post which suggests to people to hack the core module to reenable session tokens.
An ideal solution would be to offer a checkbox on each webform's settings page enabling people to selectively disable cache for that page and re-enable session tokens, avoiding the security issue and restoring previous functionality.
Is this possible?
Thanks,
Jonny
| Comment | File | Size | Author |
|---|---|---|---|
| #2 | session_anonymous.patch | 615 bytes | thedavidmeister |
Comments
Comment #1
quicksketchI believe this solution would also fix the problem without disabling the page cache: #630476: Allow hidden fields to handle unsafe tokens by making the "value" type fields. If you could try it out and see if it works for you, that would help move it forward.
Comment #2
thedavidmeister commentedhere's a patch that implements the hack in the forum post referenced. applies for webform version 6.x-3.9
Comment #3
quicksketchI would strongly suggest against taking that approach. If your users put things like %server['REQUEST_ADDR'] or %cookie['SESSID'] into a hidden field you'll end up with anonymous users getting each others private information (because the page cache will save the first user's values and show it to other users).
As said, I think #630476: Allow hidden fields to handle unsafe tokens by making the "value" type fields is the correct approach. The patch attached here may work but it could lead to privacy leaking and it's a hack.