Configure Secure and HttpOnly Cookies for Enhanced Session Security

<?php
// Recommended secure session configuration for PHP
ini_set('session.cookie_httponly', 1); // Prevent JavaScript access to cookies
ini_set('session.cookie_secure', 1);   // Only send cookies over HTTPS
ini_set('session.cookie_samesite', 'Lax'); // Protect against CSRF

// Optionally set session cookie lifetime (e.g., 1 hour)
ini_set('session.cookie_lifetime', 3600);

// Ensure session starts after configuration
session_start();

// Example of setting a custom cookie with these flags
// (session_start() handles these for the session cookie automatically if ini_set is used)
$cookie_name = "user_preference";
$cookie_value = "dark_mode";
$expiration = time() + (86400 * 30); // 30 days
$path = "/";
$domain = $_SERVER['HTTP_HOST']; // Or specify a fixed domain
$secure = true; // Only send over HTTPS
$httponly = true; // Prevent JavaScript access
$samesite = 'Lax'; // 'Lax', 'Strict', or 'None' (requires secure=true)

// PHP 7.3+ setcookie with options array
setcookie($cookie_name, $cookie_value, [
    'expires' => $expiration,
    'path' => $path,
    'domain' => $domain,
    'secure' => $secure,
    'httponly' => $httponly,
    'samesite' => $samesite
]);

// For older PHP versions (before 7.3), samesite needs to be appended to the path/domain arguments
// setcookie($cookie_name, $cookie_value, $expiration, $path . '; SameSite=' . $samesite, $domain, $secure, $httponly);

echo "Secure cookie settings applied and session started.";
?>