>1. In session_start(), it is possible to override ini settings like that: > >```php >session_start([ 'use_cookies' => '1', 'use_only_cookies' => '1', >'referer_check' => '' ]); >``` > >The relevant options should also be deprecated in that context.
Yes, they are. You can see that in my draft PR https://github.com/php/php-src/pull/13578 > 2. A clarification: Suppose that I have `session.use_only_cookie = 1` in my > ini file (no deprecation warning), and I call > `ini_set("session.use_only_cookie", "1")` in my code (no-op). Will the > `ini_set(...)` invocation trigger a deprecation warning? As mentioned in the RFC, only changing the option to the deprecated value triggers the deprecation. You can verify this using my draft PR. Similarly, if your INI file triggers a deprecations due to for example session.use_only_cookie=0 and then in your PHP file you change it using ini_set("session.use_only_cookie", "1") or using the argument to session_start(), it will only trigger the deprecation during startup and not during runtime of the script.
