Problem/Motivation

Follow-up from #3465836: PHP 8.4 session.sid_length and session.sid_bits_per_character are deprecated. We can probably just remove these altogether and rely on the PHP defaults.

For sites that have them explicitly set, we might want to issue a deprecation notice when they're set, prior to removal of support altogether?

Steps to reproduce

- see deprecation in core/lib/Drupal/Core/CoreServiceProvider.php
https://git.drupalcode.org/project/drupal/-/commit/e39157a2add9041503902...
- core/.deprecation-ignore.txt in #9

Proposed resolution

Remaining tasks

User interface changes

Introduced terminology

API changes

Data model changes

Release notes snippet

Issue fork drupal-3471199

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

catch created an issue. See original summary.

andypost’s picture

andypost
he/him
Primary language Russian
commented
Issue tags: +PHP 8.4

Probably we can remove it only when PHP 8.4 will be minimally required version as some sites can tune the seting

andypost’s picture

andypost
he/him
Primary language Russian
commented

When core will require Symfony 7.2 looking at https://github.com/symfony/symfony/pull/57805

andypost’s picture

andypost
he/him
Primary language Russian
commented
Issue tags: +Symfony 7.2
andypost’s picture

andypost
he/him
Primary language Russian
commented
Related issues: +#3470075: PHP 8.4 GET/POST sessions are deprecated
longwave’s picture

longwave
he/him
Primary language English
Location UK
commented

@andypost Drupal 11.1 should be on Symfony 7.2, waiting for beta hopefully in early November.

andypost’s picture

andypost
he/him
Primary language Russian
commented

Thank you! The same time PHP will get GA at 21 Nov)

cilefen’s picture

cilefen commented

Was this completed in #3483978: Update to Symfony 7.2.0-BETA1?

Separately, #3490814: Regression? PHP 8.4 session.sid_length and session.sid_bits_per_character are deprecated seems to be the other problem this issue intends to fix, "sites that have them explicitly set", so I marked it a duplicate.

andypost’s picture

andypost
he/him
Primary language Russian
commented

There's at least silencing in core/.deprecation-ignore.txt and it needs to figure out more

# Symfony 7.2
%Since symfony/http-foundation 7.2: NativeSessionStorage's "sid_length" option is deprecated and will be ignored in Symfony 8.0.%
%Since symfony/http-foundation 7.2: NativeSessionStorage's "sid_bits_per_character" option is deprecated and will be ignored in Symfony 8.0.%
andypost’s picture

andypost
he/him
Primary language Russian
commented
Issue tags: +Symfony 8.0
andypost’s picture

andypost
he/him
Primary language Russian
commented
Issue summary: View changes

So wait for SF 8.0 for removal deprecation in core/lib/Drupal/Core/CoreServiceProvider.php
https://git.drupalcode.org/project/drupal/-/commit/e39157a2add9041503902...

andypost’s picture

andypost
he/him
Primary language Russian
commented

November'25-July'26 https://symfony.com/releases/8.0

andypost’s picture

andypost
he/him
Primary language Russian
commented
Related issues: +#3530186: Switch to argon2 as the default password hashing algorithm

Version: 11.x-dev » main

Drupal core is now using the main branch as the primary development branch. New developments and disruptive changes should now be targeted to the main branch.

Read more in the announcement.

andysipple’s picture

andysipple commented

Thank you!
Commenting out sid_length and sid_bits_per_character in my services.pantheon.preproduction.yml and services.pantheon.production.yml
Fixed the issue.
Was filling up the logs when anyone would login and view any page. Every page request would get this deprecated message.

longwave opened merge request !14589

longwave’s picture

longwave
he/him
Primary language English
Location UK
commented
Status: Active » Needs review
longwave’s picture

longwave
he/him
Primary language English
Location UK
commented
Title: Remove sid_length and sid_bits_per_character from default.services.yml » Remove sid_length and sid_bits_per_character deprecation from CoreServiceProvider
smustgrave’s picture

smustgrave commented
Status: Needs review » Reviewed & tested by the community

Seems like a good removal.

  • catch committed 1f86870f on main 
    task: #3471199 Remove sid_length and sid_bits_per_character deprecation...
catch’s picture

catch
he/him
Primary language English
commented
Status: Reviewed & tested by the community » Fixed

Committed/pushed to main, thanks!

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

catch closed merge request !14589

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

yesct’s picture

yesct commented

Hm. Seems like just missed being included in Feb 5 release https://www.drupal.org/project/drupal/releases/11.3.3
Maybe going out in todays release?? https://www.drupal.org/about/core/policies/core-release-cycles/schedule