Securing a session cookie in PHP - Sécuriser un cookie de session en PHP
Publié le .It is important to properly secure your session cookies in order to protect yourself against the theft of cookie data.
Here is my way of doing it... But it is not exhaustive, also look for information elsewhere.
Il est important de bien sécuriser ses cookies de session afin de se prémunir contre le vol des données du coockie.
voici ma façon de faire ... Mais elle n'est pas exhaustive, cherchez aussi des informations ailleurs.
<?php
/*
* You can find the list of options at this address:
* https://www.php.net/manual/fr/session.security.ini.php
*/
// start a securised session :
session_start([
'name' => 'MY-API',
'use_strict_mode' => true,
'cookie_samesite' => 'Strict',
'cookie_lifetime' => 30, // in seconds
'gc_maxlifetime' => 30, // in seconds
'cookie_secure' => true,
'cookie_httponly' => true
]);
?>
/*
* You can find the list of options at this address:
* https://www.php.net/manual/fr/session.security.ini.php
*/
// start a securised session :
session_start([
'name' => 'MY-API',
'use_strict_mode' => true,
'cookie_samesite' => 'Strict',
'cookie_lifetime' => 30, // in seconds
'gc_maxlifetime' => 30, // in seconds
'cookie_secure' => true,
'cookie_httponly' => true
]);
?>