Configuring Secure PHP Session Cookies

<?php
// Recommended: Set these configurations before session_start()
// It's even better to set them in php.ini for global application security.

// 1. HttpOnly: Prevents client-side scripts from accessing the session cookie.
//    Mitigates XSS attacks by making it harder to steal session IDs.
ini_set('session.cookie_httponly', 1);

// 2. Secure: Ensures the session cookie is only sent over HTTPS connections.
//    Prevents interception of session IDs over insecure HTTP.
//    Only enable this in production environments that exclusively use HTTPS.
if (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on') {
    ini_set('session.cookie_secure', 1);
} else {
    // For development on HTTP, or if HTTPS is not universally enforced,
    // you might set this to 0, but it's a security risk in production.
    // It's strongly recommended to always use HTTPS in production.
    ini_set('session.cookie_secure', 0);
}


// 3. SameSite: Protects against Cross-Site Request Forgery (CSRF) attacks.
//    'Lax': Send cookies for top-level navigations and safe HTTP methods (GET).
//           Good balance of security and compatibility.
//    'Strict': Send cookies only for same-site requests. Most secure, but can break external links.
//    'None': Send cookies for all requests (requires 'Secure' and is less secure).
//    The default is often 'Lax' in modern browsers if not specified.
ini_set('session.cookie_samesite', 'Lax');

// Other important session settings:

// 4. Session ID regeneration: Regenerate ID after login or privilege change.
//    Prevents session fixation attacks.
//    session_start(); // Call this first if you need to access $_SESSION before regeneration
//    session_regenerate_id(true); // Call after session_start()

// 5. Session lifetime: Set a reasonable expiration time.
//    Defaults to php.ini session.gc_maxlifetime.
ini_set('session.gc_maxlifetime', 1440); // 24 minutes
ini_set('session.cookie_lifetime', 0); // 0 means 'until the browser is closed'

// 6. Use cookies for session IDs, not URLs.
//    Prevents session ID leaking in URLs.
ini_set('session.use_cookies', 1);
ini_set('session.use_only_cookies', 1); // Crucial for security


// Start the session AFTER all ini_set calls
session_start();

// Example of using the session
if (!isset($_SESSION['views'])) {
    $_SESSION['views'] = 0;
}
$_SESSION['views']++;

echo "Page views: " . $_SESSION['views'] . "
";
echo "Session ID: " . session_id() . "
";
?>