Session cookies http & secure flag - how do you set these?

Question

Just received the results of a security audit - everything clear apart from two things

Session cookie without http flag.

Session cookie without secure flag set.

The application is coded in php and the suggestions to fix are:

1. set session cookie with http only flag
2. set session cookie with secure flag

I have looked at examples but don't fully understand how to implement on a Linux server. I don't have access to the .ini file . Is it possible to set these in the htaccess file?

Alternatively, how and where do I implement in the code?

Answer 1

You can set them before you send the header. Just add these line below in you code.

<?php // **PREVENTING SESSION HIJACKING** // Prevents javascript XSS attacks aimed to steal the session ID ini_set('session.cookie_httponly', 1);  // **PREVENTING SESSION FIXATION** // Session ID cannot be passed through URLs ini_set('session.use_only_cookies', 1);  // Uses a secure connection (HTTPS) if possible ini_set('session.cookie_secure', 1);