Search code examples
phpsecuritysession-cookies

Set httpOnly and secure on PHPSESSID cookie in PHP

Whats the recommended way to set httponly and secure flags on the PHPSESSID cookie?

I found http://www.php.net/manual/en/session.configuration.php#ini.session.cookie-httponly. Any better suggestions?

thanks

Solution

  • In my opinion the best would be: http://www.php.net/manual/en/function.session-set-cookie-params.php

    void session_set_cookie_params ( int $lifetime [, string $path [, string $domain [, bool $secure = false [, bool $httponly = false ]]]] )