Is session.cookie_secure in php.ini automatic? -
simple answer requested: if put
session.cookie_httponly=on session.cookie_secure=on
in php.ini file website, automatically turn php cookies secure , httponly, or still need put in true, true parameter slots 6 , 7 in cookie itself?
the answer yes. setting in php.ini enough (however, saw "true" setting used instead of "on").
- session cookie without httponly flag set
- https://www.owasp.org/index.php/httponly#using_php_to_set_httponly
you can verify setting these values, restarting webserver , accessing site browser, e.g. firefox. open "site information", , choose "security" tab , click on cookies. there can see if it's marked secure.
Comments
Post a Comment