33

Whats the recommended way to set httponly and secure flags on the PHPSESSID cookie?

I found http://www.php.net/manual/en/session.configuration.php#ini.session.cookie-httponly. Any better suggestions?

thanks

2
  • 6
    That and session.cookie_secure is basically it. I don't think there are any easier / better methods.
    – Wrikken
    Jul 25, 2011 at 20:29
  • Are you aware that ini_set() works just fine with session.cookie_httponly and session.cookie_secure? Just set them before you call session_start().
    – jorisw
    Jan 16, 2013 at 13:51

8 Answers 8

24
ini_set('session.cookie_httponly', 1);

more information here on the PHP docs

3
22

In my opinion the best would be: http://www.php.net/manual/en/function.session-set-cookie-params.php

void session_set_cookie_params ( int $lifetime [, string $path [, string $domain [, bool $secure = false [, bool $httponly = false ]]]] )
5
  • yeah but this affects all cookies?
    – Steve
    Jul 26, 2011 at 6:36
  • This will only affect session cookies (PHPSESSID) for a single site. Did you want a server wide setting?
    – Johan
    Jul 26, 2011 at 7:18
  • my bad. temporary blindness... combining session_get_cookie_params() to get the lifetime, path, etc then passing those back to session_set_cookie_params() will do all that i need. thanks!
    – Steve
    Jul 26, 2011 at 22:04
  • I recommend setting this at the php.ini level. The reason is that it is fairly easy to mess up PHP code. For example, some complex PHP applications can be accessed through direct HTML document request, AJAX requests, cron tasks, etc. that may have multiple places where start_session() is called. Additionally, configuration may be off. Just my input, I think this makes the most sense as session.cookie_domain=1 and session.cookie_secure=1 in php.ini. Simple, and done.
    – ryanm
    Jan 24, 2018 at 13:58
  • 1
    ryanm : According to php.ini and php.net/manual/en/… session.cookie_domain is a string for the domain not a boolean ; The domain for which the cookie is valid. ; php.net/session.cookie-domain session.cookie_domain =
    – jmatos
    Sep 3, 2019 at 9:01
18

I was unable to get the secure flag working with session_set_cookie_params(...), so what I did was, after session_start() set the PHPSESSID cookie, I reset it with setcookie(...). The final parameter, true, makes the cookie have a secure flag.

<?php  
session_start();  
$currentCookieParams = session_get_cookie_params();  
$sidvalue = session_id();  
setcookie(  
    'PHPSESSID',//name  
    $sidvalue,//value  
    0,//expires at end of session  
    $currentCookieParams['path'],//path  
    $currentCookieParams['domain'],//domain  
    true //secure  
);  
?>

When I checked the PHPSESSID cookie in Firefox, its 'Send for' property was set to 'Encrypted connections only' and its 'Expires' property was set to 'At end of session'.

3
  • This method worked for me when session_set_cookie_params would not.
    – Sharlike
    Jan 28, 2014 at 17:21
  • There's a more concise alternative: session_regenerate_id(). See stackoverflow.com/a/27242745/560114. (Not sure whether such a workaround [either yours or session_regenerate_id()] is still needed in newer versions of PHP.) Jun 15, 2016 at 17:55
  • Never mind, it turns out I was being thrown off by caching - simply using ini_set() to set session.cookie_httponly and session.cookie_secure or putting the settings in an htaccess file should be sufficient, at least as of PHP 5.3.3. Jun 15, 2016 at 18:07
6

A more elegant solution since PHP >=7.0

session_start(['cookie_lifetime' => 43200,'cookie_secure' => true,'cookie_httponly' => true]);

session_start

session_start options

1
  • Where do we need to add the above code? Apr 14 at 4:36
2

I use Apache httpd over HTTPS, set session.cookie_httponly = 1 & session.cookie_secure = 1 works for me.

2

For a WordPress website, I fixed it using the following PHP code:

add_action('init', 'start_session', 1);
function start_session() {
    if(!session_id()) {
        session_start();
        $currentCookieParams = session_get_cookie_params();
        $sidvalue = session_id();
        setcookie(
            'PHPSESSID',//name
            $sidvalue,//value
            0,//expires at end of session
            $currentCookieParams['path'],//path
            $currentCookieParams['domain'],//domain
            true //secure
        );
    }
}

add_action('wp_logout','end_session');
add_action('wp_login','end_session');
function end_session() {
    session_destroy();
}

Paste the code in the functions.php file.

0

If you are using Apache, try this on your .htaccess

php_value session.cookie_httponly 1
0

Using .htaccess for this purpose just slows down your application.

I think its better to add this snippet in your main config file ( example config.php ) or main include file ( example global.php )

    // Prevents javascript XSS attacks aimed to steal the session ID
    ini_set('session.cookie_httponly', 1);

    // Prevent Session ID from being passed through  URLs
    ini_set('session.use_only_cookies', 1);

If you are using https:// instead of http:// , then also do

     // Uses a secure connection (HTTPS) 
     ini_set('session.cookie_secure', 1); 

This method is also suitable for thos who dont have access to php.ini

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.