Whether a response changes any cookie the request arrived with.
Mere presence of Set-Cookie is the wrong test: PHP re-emits the session cookie on every
session_start() while session.cookie_lifetime is non-zero (Drupal ships 2000000), so every
authenticated response carries one equal to the request's. A re-send cannot change whose key this
is; a new value or a deletion (login, logout, session regeneration) can, and refuses.
Whether a response changes any cookie the request arrived with.
Mere presence of
Set-Cookieis the wrong test: PHP re-emits the session cookie on everysession_start()whilesession.cookie_lifetimeis non-zero (Drupal ships 2000000), so every authenticated response carries one equal to the request's. A re-send cannot change whose key this is; a new value or a deletion (login, logout, session regeneration) can, and refuses.