By andypost on
Change record status: 
Published (View all published change records)
Project: 
Drupal core
Introduced in branch: 
10.4.x, 11.x
Introduced in version: 
10.4.0, 11.1.0
Issue links: 
https://www.drupal.org/node/3470075
Description: 

As of PHP 8.4 passing session via URL is deprecated, moreover following session settings are deprecated: session.use_only_cookies, session.use_trans_sid and session.referer_check

According to RFC

Using automatic transformation of URLs will become impossible out of the box starting with PHP 9.0. To keep using this feature, PHP users will have to implement it in userland. While PHP will not read the session token from GET/POST parameters automatically anymore, it will still be possible to start a session with an ID received in such a way by manually setting it via session_id()

Impacts: 
Module developers