Sessions Settings - Possible regression with `Form::hide_session_id()` after PHP 8.4 session changes (v1.1.0.7)
Posted: Wed Aug 05, 2026 12:35 pm
While upgrading my testshop to Phoenix 1.1.0.7, I noticed what appears to be an inconsistency regarding session handling in the admin.
### Configuration
* Phoenix 1.1.0.7
* PHP 8.0.30
* **Force Cookie Use = True**
### Test case
Using a simple GET form in the admin:
Submitting this form causes my admin session to be lost and I am redirected to the storefront.
If I remove only hide_session_id()
the same form works perfectly.
Additional observation - If I set:
Force Cookie Use = False
the admin form also works, but the storefront starts appending the session ID to URLs again, for example:
shopping_cart.php?sort=1a&ceid=xxxxxxxxxxxxxxxx
So I end up with:
Force Cookie Use = False
* Admin GET forms work.
* Session ID (`ceid`) is appended to storefront URLs.
Force Cookie Use = True
* Storefront URLs are clean (preferred).
* GET forms using `->hide_session_id()` lose the admin session.
Looking at commit https://github.com/CE-PhoenixCart/Phoen ... 77a35aae8b
I noticed that the PHP 8.4 session changes modified both:
* includes/system/segments/application/start_session.php
* includes/system/versioned/1.01.00.07/form.php
It seems that hide_session_id() now always adds the current session ID whenever a session exists, while Href already respects the **Force Cookie Use** setting.
### Question
Is this the expected behaviour?
Should `Form::hide_session_id()` also respect the **Force Cookie Use** configuration when using GET forms, or is there something in my configuration that I have overlooked?
I appreciate any feedback before I start modifying Core code
.
Thanks!
### Configuration
* Phoenix 1.1.0.7
* PHP 8.0.30
* **Force Cookie Use = True**
### Test case
Using a simple GET form in the admin:
Code: Select all
<?= (new Form('status', $Admin->link('orders.php'), 'get'))->hide_session_id() ?>If I remove only hide_session_id()
Code: Select all
<?= (new Form('status', $Admin->link('orders.php'), 'get') ?>Additional observation - If I set:
Force Cookie Use = False
the admin form also works, but the storefront starts appending the session ID to URLs again, for example:
shopping_cart.php?sort=1a&ceid=xxxxxxxxxxxxxxxx
So I end up with:
Force Cookie Use = False
* Admin GET forms work.
* Session ID (`ceid`) is appended to storefront URLs.
Force Cookie Use = True
* Storefront URLs are clean (preferred).
* GET forms using `->hide_session_id()` lose the admin session.
Looking at commit https://github.com/CE-PhoenixCart/Phoen ... 77a35aae8b
I noticed that the PHP 8.4 session changes modified both:
* includes/system/segments/application/start_session.php
* includes/system/versioned/1.01.00.07/form.php
It seems that hide_session_id() now always adds the current session ID whenever a session exists, while Href already respects the **Force Cookie Use** setting.
### Question
Is this the expected behaviour?
Should `Form::hide_session_id()` also respect the **Force Cookie Use** configuration when using GET forms, or is there something in my configuration that I have overlooked?
I appreciate any feedback before I start modifying Core code
.Thanks!