Search code examples
phpsessionsession-cookies

HttpOnly still being set to false even after making changes to Apache config file and php.ini

I have made the following attempts at trying to set HttpOnly to `true.

Attempt #1 - Add ini_set function

<?php 
ini_set( 'session.cookie_httponly', 1 );
session_start();
echo "hello";

setcookie("name", "Stevesy", time() + 3600);

?>

Attempt #2 - Add the following to httpd.conf file

<IfModule php5_module>
    php_flag session.cookie_httponly on
</IfModule>

Attempt #3 - Change session.cookie_httponly in php.ini to true

I have restarted the Apache web server.

enter image description here

Edit: I was able to change the HttpOnly of the cookie I set, name: Stevesy, to true. But PHPSESSION is still false.

Solution

  • As /u/nice_dev suggested, it does work in incognito mode.

    Edit: To be clear, attempts #1 and #3 both work fine. I didn't test #2.