Is your feature request related to a problem? Please describe.
In Europe, GDPR/ePrivacy require consent for cookies, or at minimum an explicit
notice for strictly necessary ones — in practice: an annoying cookie banner.
HTMLy calls session_start() unconditionally on every request, so every
anonymous visitor receives a PHPSESSID cookie. The session behind it stays
empty and is never read for anonymous visitors — the cookie has no function for
them, but it still forces site owners to add a banner. And (if someone is picky - it is not even a strictly necessary cookie since it's only necessary for the admins)c
The cause is easy to miss: system/includes/session.php is loaded through the
autoload.files section of composer.json, so it executes on every request,
including plain blog pages served from the file cache.
Describe the solution you'd like
The naked htmly (without the external features like facebook) uses cookies only for admin logins.
Solution would be to only set the session-cookie for admins and not for anonymous users. Therefore the basic install would be GDPR-compliant without the need for annoying banners.
Start the session lazily: only when the client already sends a session cookie.
Everything that needs to create a session already starts it explicitly.
Third-party integrations (Disqus, Facebook comments, Google Analytics/gtag,
YouTube embeds) of course still set their own cookies when enabled — but those
are opt-in -, so the default install stays cookie-free for non-admins.
In case someone in Europe uses third-party integration he needs to implement a cookie banner.
Describe alternatives you've considered
- Implement the mandatory cookie banner :(
Additional context
Is your feature request related to a problem? Please describe.
In Europe, GDPR/ePrivacy require consent for cookies, or at minimum an explicit
notice for strictly necessary ones — in practice: an annoying cookie banner.
HTMLy calls
session_start()unconditionally on every request, so everyanonymous visitor receives a
PHPSESSIDcookie. The session behind it staysempty and is never read for anonymous visitors — the cookie has no function for
them, but it still forces site owners to add a banner. And (if someone is picky - it is not even a strictly necessary cookie since it's only necessary for the admins)c
The cause is easy to miss:
system/includes/session.phpis loaded through theautoload.filessection ofcomposer.json, so it executes on every request,including plain blog pages served from the file cache.
Describe the solution you'd like
The naked htmly (without the external features like facebook) uses cookies only for admin logins.
Solution would be to only set the session-cookie for admins and not for anonymous users. Therefore the basic install would be GDPR-compliant without the need for annoying banners.
Start the session lazily: only when the client already sends a session cookie.
Everything that needs to create a session already starts it explicitly.
Third-party integrations (Disqus, Facebook comments, Google Analytics/gtag,
YouTube embeds) of course still set their own cookies when enabled — but those
are opt-in -, so the default install stays cookie-free for non-admins.
In case someone in Europe uses third-party integration he needs to implement a cookie banner.
Describe alternatives you've considered
Additional context