Setting the HTTPOnly flag for PHPSESSID cookie [closed]

Question

I am getting this message from my security audit:

Cookie name: "PHPSESSID"

Cookie domain: "xxx.xxx.xx.xxx"

If possible, you should set the HTTPOnly flag for this cookie.

How can I set the HTTPOnly flag for this cookie?

Answer 1

You have at least 3 ways to achieve that:

1. In the PHP configuration file (php.ini), look for session.cookie_httponly setting and set it to True.

2. If you don't have access to PHP configuration, you can try to overwrite this setting at runtime:

ini_set("session.cookie_httponly", 1);

3. If it doesn't work, you have to manually overwrite that cookie:

session_start();
$params = session_get_cookie_params();
setcookie("PHPSESSID", session_id(), 0, $params["path"], $params["domain"],
    false,  // this is the secure flag you need to set. Default is false.
    true  // this is the httpOnly flag you need to set
);

---

setcookie() definition:

bool setcookie ( string $name [, string $value = "" [, int $expire = 0 [, string $path = "" [, string $domain = "" [, bool $secure = false [, bool $httponly = false ]]]]]] )