I tried something once. On Github it was described how to prevent the session from starting. But then the login no longer works.
But you could do it a little differently:
In the core/bootstrap.php the session is started like this:
if ((! is_cli() && session_status() === PHP_SESSION_NONE) && (!defined('NO_SESSION'))) {
startCMSSession(); // start session
}
If you additionally couple this to the manager, it looks like this:
if ((! is_cli() && session_status() === PHP_SESSION_NONE) && (!defined('NO_SESSION') && strpos($_SERVER["REQUEST_URI"],"manager")!==false )) {
startCMSSession(); // start session
}
Now you can use the site without evocookie. When you login to the backend, the evocookie is set.
But I don't know if it is problematic to bind the evocookie to the presence of "manager" in the $_SERVER["REQUEST_URI"].
I also hope it's not a problem safety-wise.
Perhaps someone who is more familiar with EVO security can chime in. I am currently only running this in a test environment.
