Don't use session for multilang because of EU regulations

I know there has been discussion about, like here:
https://forum.getkirby.com/t/eu-cookie-regulations-what-if-kirby-cookies-arent-necessary/1968

and the result was, that from Kirby 2.2 no longer any cookies stored by default.

However, I am on Kirby 2.3.0, and just updated to 2.3.2 this morning, and I find that still the kirby_session cookie gets placed. I removed the cookie manually, but it gets renewed any time a page is loaded.

What can I do to get away from this cookie? I do not want to implement a cookie nag screen. I do not use any cookie for my project.

Thank you,
Bernward

Are you logged in to the panel?
Try testing on a clean browser and not logging in.

Thiousi,
I’m not on the panel. The panel is not installed in my online version.
I have it only on my local test server. Editing is mostly done via text editor.
The panel sets a different cookie named kirby_session_auth.

1 Like

Is that a fresh starterkit? Do you use any plugins?

You’re right, I’ve just tested this on a server without the panel and I get the same cookie you get. Running 2.3.1

Tested on starterkit 2.3.2 => no cookies

I just installed a fresh starterkit and can’t see any cookies. I have several sites that use the uniform plugin, these use session cookies.

It has been the “Kirby CMS Bootstrap Blog Starterkit” from the Themes Showcase in the very beginning…
I removed much and added much more.
I use

Uniform is not used (I considered to use it but I took the simple contact form)

So good to know a pure Kirby sets no cookies. I will check all my PHP files in the project.

Am I right that there must be an API cookie function call somewhere?

The only place I can find the string “kirby_session” allover my project, is in the s.php file, located in the kirby\toolkit\lib folder.

Can you search for cookie::set ?
https://getkirby.com/docs/toolkit/api/cookie/set

“cookie::set” appears in
kirby\core\user.php
kirby\toolkit\lib\cookie.php

My update process was always

  1. removing the complete \kirby and \panel folders
  2. replacing them from the update .zip file
    so nothing of any old version should be present.

Do you use any authentication on the frontend?

No I don’t.

I wonder if the bootstrap js code use cookies. There is bootstrap.min.js and jquery-1.12.3.min.js
But why should they name it “kirby_session”?

My project is multilanguage. This seems important.
I temporary removed the s.php and got an error:
Fatal error: Class ‘s’ not found in D:\Test\CMS\kirby-bootstrap-starterkit\kirby\kirby.php on line 690

There, from line 688 in kirby.php it says:

// store the current language in the session

Oh, alright, that explains it all then :slight_smile: I just installed a langkit, and there we get the session cookie.

We have the www.mysite.de/page for German and www.mysite.de/en/page for English.
I disabled Cookies in my browser, doing so I can perfectly navigate through my English and also German content.

Seems the session cookie is not really needed for language switching.

I think that is used to remember the language for returning visitors.

Did you activate the detect language feature of the langkit ?
Edit: I just tested this. The language detect isn’t the origin of the cookie.

The language detect is not active.
I think the language detection looks for this cookie only if active (line 262 - 264).
But the cookie is set any case.

That’s right, the cookie is always set if the site is a multilingual site.