How to set an HttpOnly cookie in PHP?

Question

How to set cookies in PHP apps like HttpOnly cookies ?

Answer 1

• For your cookies, see this answer.
• For a native PHP script file ( PHPSESSID , by default), see @richie answer

setcookie() and setrawcookie() functions introduced the httponly parameter in the dark of PHP 5.2.0, which makes it nice and easy. Just set the 7th parameter to true according to the syntax

Function syntax simplified for brevity

 setcookie( $name, $value, $expire, $path, $domain, $secure, $httponly ) setrawcookie( $name, $value, $expire, $path, $domain, $secure, $httponly ) 

Enter NULL for the parameters you want to keep by default. You may also consider setting the secure parameter.

It is also possible to use the older header() function:

 header( "Set-Cookie: name=value; httpOnly" ); 

Answer 2

For native PHP session scripts on Apache:
add this to your apache or .htaccess configuration

 <IfModule php5_module> php_flag session.cookie_httponly on </IfModule> 

It can also be set in a script if it is called before session_start() .

 ini_set( 'session.cookie_httponly', 1 ); 

Answer 3

Remember that HttpOnly does not stop cross-site scripting; instead, it neutralizes one possible attack and currently only does it in IE (FireFox provides HttpOnly cookies in XmlHttpRequest, and Safari does not comply with it at all). By all means, turn on HttpOnly, but don’t lose even an hour of filtering the output and testing fuzz in trading for it.

Answer 4

Please note that the PHP session cookie does not use httponly by default.

For this:

 $sess_name = session_name(); if (session_start()) { setcookie($sess_name, session_id(), null, '/', null, null, true); } 

A few notes here:

• You need to call session_name() before session_start()
• This also sets the default path to '/', which is necessary for Opera, but which PHP session cookies are not executed by default either.

Answer 5

The explanation here is from Ilia ... 5.2, though

httpOnly cookie flag support in PHP 5.2

As stated in this article, you can set the header yourself in previous versions of PHP

 header("Set-Cookie: hidden=value; httpOnly"); 

Answer 6

You can specify it in the set cookie function see php manual

 setcookie('Foo','Bar',0,'/', 'www.sample.com' , FALSE, TRUE); 

Answer 7

 <?php //None HttpOnly cookie: setcookie("abc", "test", NULL, NULL, NULL, NULL, FALSE); //HttpOnly cookie: setcookie("abc", "test", NULL, NULL, NULL, NULL, TRUE); ?> 

Source

Answer 8

You can use this in the header file.

 // setup session enviroment ini_set('session.cookie_httponly',1); ini_set('session.use_only_cookies',1); 

This way all future cookies will use httponly.

Answer 9

The correct syntax for the php_flag command

 php_flag session.cookie_httponly On 

And remember that only the first response from the server set a cookie here too (for example, you can see the HttpOnly directive. Therefore, for testing, delete cookies from the browser after each request for testing.