I am getting this message from my security audit:
Cookie name: "PHPSESSID"
Cookie domain: "xxx.xxx.xx.xxx"
If possible, you should set the HTTPOnly flag for this cookie.
How can I set the HTTPOnly flag for this cookie?
You have at least 3 ways to achieve that:
In the PHP configuration file (php.ini), look for session.cookie_httponly setting and set it to True.
If you don't have access to PHP configuration, you can try to overwrite this setting at runtime:
session_start(); $params = session_get_cookie_params(); setcookie("PHPSESSID", session_id(), 0, $params["path"], $params["domain"], false, // this is the secure flag you need to set. Default is false. true // this is the httpOnly flag you need to set );
bool setcookie ( string $name [, string $value = "" [, int $expire = 0 [, string $path = "" [, string $domain = "" [, bool $secure = false [, bool $httponly = false ]]]]]] )