English
English
session_set_cookie_params() is a function used to set the parameters of PHP session cookies. These parameters include the cookie’s lifetime, path, domain, whether it should be transmitted over secure HTTPS connections, and more. Using this function, developers can ensure session security and stability while avoiding potential security risks.
session_set_cookie_params([
'lifetime' => 3600, // Cookie lifetime in seconds
'path' => '/', // Cookie path
'domain' => 'm66.net', // Domain set to m66.net
'secure' => true, // Transmit cookie only over HTTPS
'httponly' => true, // Disallow JavaScript access to cookie
'samesite' => 'Strict' // Set SameSite policy
]);
lifetime
The lifetime parameter sets the duration (in seconds) that the session cookie remains valid. By default, PHP session cookies expire when the browser session ends. To keep the session valid even after the browser closes, you can set a longer lifetime. For example, 3600 means the cookie lasts for 1 hour.
path
The path parameter controls the path on the server where the cookie is accessible. If set to the root /, the cookie is available across all subdirectories. To restrict cookie access to a specific path, set this parameter accordingly.
domain
The domain parameter defines the domain scope of the cookie — which domain(s) can access this cookie. To support sessions across multiple subdomains, you can set it to m66.net, allowing the cookie to be shared across this domain and all its subdomains. Note that the domain must match the current request domain; otherwise, the cookie won’t be available.
secure
The secure parameter specifies whether the cookie should only be transmitted over secure HTTPS connections. When set to true, the browser will only send the cookie via HTTPS. This is a crucial security measure, especially when handling sensitive data.
httponly
The httponly parameter controls whether the cookie is accessible via client-side JavaScript. If set to true, the cookie is only accessible through HTTP(S) protocols and is protected from JavaScript access, helping prevent cross-site scripting (XSS) attacks.
samesite
The samesite parameter defines the same-site cookie policy, designed to protect against cross-site request forgery (CSRF) attacks. Common options include:
'Strict': Cookies are only sent in requests originating from the same site.
'Lax': Cookies are sent with some cross-site requests, suitable for certain use cases.
'None': Disables the SameSite policy entirely but requires secure to be set to true.
Suppose we have an e-commerce website and want users to remain logged in for a longer time on the shopping cart page, while other pages (such as the login page) don’t require such long session durations. We can use session_set_cookie_params() to set different lifetimes and policies to meet the needs of different pages.
// Set session cookie for login page
session_set_cookie_params([
'lifetime' => 1800, // 30 minutes
'path' => '/',
'domain' => 'm66.net',
'secure' => true,
'httponly' => true,
'samesite' => 'Strict'
]);
<p>// Start the session<br>
session_start();</p>
<p>// Set session cookie for cart page<br>
session_set_cookie_params([<br>
'lifetime' => 86400, // 24 hours<br>
'path' => '/cart',<br>
'domain' => 'm66.net',<br>
'secure' => true,<br>
'httponly' => true,<br>
'samesite' => 'Lax'<br>
]);</p>
<p>// Start the session<br>
session_start();<br>
In this example, the login page session lasts 30 minutes, while the cart page session lasts 24 hours. By setting the domain to m66.net, both pages share the same session cookie. The secure and httponly settings improve session security.
Using session_set_cookie_params() helps developers achieve fine-grained session management. Common use cases include:
Enhanced Security
Using the secure and httponly parameters prevents session cookies from being stolen by malicious JavaScript, boosting security, especially when handling sensitive data.
Cross-site Session Management
Setting the domain parameter enables sharing session cookies across multiple subdomains, which is useful for large websites or apps spanning several subdomains.
Control Over Session Lifespan
By setting the lifetime parameter, developers can control how long sessions last according to business needs, avoiding sessions persisting indefinitely.
Prevent CSRF Attacks
The samesite parameter helps prevent cross-site request forgery attacks, safeguarding user data.
session_set_cookie_params() is a powerful and flexible PHP function that enables developers to precisely control session cookie management strategies. By properly configuring its parameters, developers can not only enhance application security but also optimize session management according to varying requirements. Understanding and skillfully using this function makes web applications more robust and secure.
