2 Suggestions For Improvement: GDPR Compliance And PHPSESSID Replacement

  • 1) For GDPR compliance, can you please add an option to disable IP address collection?

    Another feature for GDPR compliance would be an opt-in box. Otherwise, IP address is collected illegally from European Union residents unless they were asked to give consent right after landing on the website. However, an option to disable IP address collection would be a great first step in the direction of compliance.

    2) There are better mechanisms than PHPSESSID cookies. Good explanation of the reasons it’s not good from https://kinsta.com/blog/wordpress-cookies-php-sessions/ – is below.

    “The problem with PHP sessions all comes down to performance and caching issues. The information stored in the browser cookie has to bounce back and forth with each request so that the server knows who the user is. This means for sites that use PHPSESSID, the host would have to set the PHPSESSID to bypass the cache. However, the result is that PHPSESSID would have to be set to bypass 100% of the time, because unlike wordpress_logged_in, the PHPSESSID is set on every single PHP request.

    So imagine that the wordpress_logged_in had to be set 100% of the time to allow login functionality to work. Meaning that even logged-out users would have to have the cookie and it would have to be unique to them. Imagine that was required in order for the WordPress login system to work. In that scenario, every single page view would have to bypass cache so that the wordpress_logged_in cookie was set correctly both for logged in and logged out users.

    That’s the problem with using PHPSESSID. Because it’s generated on every single PHP request, if a site relies on PHPSESSID cookies the host would have to set PHPSESSID to bypass cache 100% of the time. Otherwise, the PHPSESSID’s end up cached and it messes up whatever functionality relies on it.”

Viewing 4 replies - 1 through 4 (of 4 total)
  • Plugin Author Bob

    (@prasunsen)

    Thanks for the suggestions.

    Thread Starter CreativeAlien

    (@creativemarsh)

    Can you please post in this forum thread again once you implemented one or both of them?

    Plugin Author Bob

    (@prasunsen)

    An option to mask IP addresses is added now in version 1.1.4.
    We cannot remove usage of $_SESSION, it’s needed for custom things, not for login.

    Thread Starter CreativeAlien

    (@creativemarsh)

    Thank you, prasunsen, for implementing this suggestion. It’ll help all users of the plugin. So I’m sure it’s appreciated by all its users.

    As far as PHPSESSID is concerned, it’s not that important. It’s acceptable the way it is. However, I’m curious about your long-term roadmap. Since there are better mechanisms, that would be great to see something else implemented in its place. I’m sure other tech-savvy users will agree. So do you plan to implement other mechanism in the future?

    Also, do you think you can implement a cookie-free mechanism in place of PHPSESSID?

    Finally, does the plugin collect and store any user agent data?

Viewing 4 replies - 1 through 4 (of 4 total)
  • The topic ‘2 Suggestions For Improvement: GDPR Compliance And PHPSESSID Replacement’ is closed to new replies.