I am getting this message from my security audit:

Cookie name: "PHPSESSID"

Cookie domain: "xxx.xxx.xx.xxx"

If possible, you should set the HTTPOnly flag for this cookie.

How can I set the HTTPOnly flag for this cookie?


You have at least 3 ways to achieve that:

  1. In the PHP configuration file (php.ini), look for session.cookie_httponly setting and set it to True.

  2. If you don't have access to PHP configuration, you can try to overwrite this setting at runtime:

ini_set("session.cookie_httponly", 1);
  1. If it doesn't work, you have to manually overwrite that cookie:
$params = session_get_cookie_params();
setcookie("PHPSESSID", session_id(), 0, $params["path"], $params["domain"],
    false,  // this is the secure flag you need to set. Default is false.
    true  // this is the httpOnly flag you need to set

setcookie() definition:

bool setcookie ( string $name [, string $value = "" [, int $expire = 0 [, string $path = "" [, string $domain = "" [, bool $secure = false [, bool $httponly = false ]]]]]] )
  • this code is not working error The page isn't redirecting properly – srinivas reddy Jul 3 '15 at 8:37
  • If you eg. use over-restricted hosting, your server configuration may prevent you from implementing all above solutions. You should then contact your administrator and ask directly about turning on session.cookie_httponly setting. – Tomasz Klim Jul 3 '15 at 9:00

Not the answer you're looking for? Browse other questions tagged or ask your own question.