Cookie still set on HTTP with ini_set('session.cookie_secure',1);

Question

My config file looks like this:

ini_set('session.cookie_secure',1);
ini_set('session.cookie_httponly',1);
ini_set('session.use_only_cookies',1);

session_start();
//database connection part...

When accessing this page via https://www.mysite.com/config.php, the PHPSESSID cookie it's "Secure" slot is empty. Visiting the page via http://www.mysite.com/config.php shows the exact same cookie, with the same value.

I'm new to this so maybe I'm wrong, but this shouldn't happen, right? What am I doing wrong?

Thanks!

Answer 1

The ini_set method requires a string value so update your code to the following:

ini_set('session.cookie_secure', '1');
ini_set('session.cookie_httponly', '1');
ini_set('session.use_only_cookies', '1');

session_start();