PHP 8.6 hardens session defaults: what actually breaks, and how an old php.ini cancels it all

; php.ini-production, PHP-8.5 branch
session.use_strict_mode = 0
session.cookie_httponly =
session.cookie_samesite =

; php.ini-production, PHP-8.6 branch
session.use_strict_mode = 1
session.cookie_httponly = 1
session.cookie_samesite = "Lax"

; docker/php/conf.d/zz-session.ini
session.use_strict_mode = 1
session.cookie_httponly = 1
session.cookie_samesite = "Lax"
; only if all traffic is HTTPS
session.cookie_secure = 1

FROM php:8.5-fpm
RUN mv "$PHP_INI_DIR/php.ini-production" "$PHP_INI_DIR/php.ini"
COPY docker/php/conf.d/zz-session.ini "$PHP_INI_DIR/conf.d/zz-session.ini"

php bin/console debug:config framework session

<?php

declare(strict_types=1);

namespace App\Controller;

use App\Payment\PaymentReturnVerifier;
use App\Repository\OrderRepository;
use Symfony\Component\HttpFoundation\RedirectResponse;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
use Symfony\Component\Routing\Attribute\Route;
use Symfony\Component\Routing\Generator\UrlGeneratorInterface;

final class PaymentReturnController
{
    public function __construct(
        private readonly PaymentReturnVerifier $verifier,
        private readonly OrderRepository $orders,
        private readonly UrlGeneratorInterface $urls,
    ) {
    }

    #[Route('/payment/return', name: 'payment_return', methods: ['POST'])]
    public function __invoke(Request $request): RedirectResponse
    {
        // Cross-site POST: with SameSite=Lax, no session cookie here.
        // So this action never touches the session.
        if (!$this->verifier->isValid($request)) {
            throw new AccessDeniedHttpException('Invalid payment return signature.');
        }

        $order = $this->orders->getByReference($request->request->getString('reference'));

        // 303: the browser follows with a GET, a top-level navigation,
        // so the session cookie is sent again.
        return new RedirectResponse(
            $this->urls->generate('order_confirmation', ['reference' => $order->getReference()]),
            Response::HTTP_SEE_OTHER,
        );
    }
}

# Compiled defaults, without any php.ini
php -n -r 'foreach (["use_strict_mode", "cookie_httponly", "cookie_samesite"] as $k) { echo $k, "=", ini_get("session.$k"), PHP_EOL; }'

# Effective CLI values (often a different php.ini than FPM)
php -i | grep -E 'session\.(use_strict_mode|cookie_httponly|cookie_samesite)'

# What the browser actually receives, on a page that starts the session
curl -sS -o /dev/null -D - https://staging.example.com/login | grep -i '^set-cookie'