Cookie Security
Set cookies with Secure, HttpOnly, and SameSite attributes to prevent theft via XSS, network interception, and CSRF.
PHP
Beginner
3 min read
Secure Cookie Settings
Example
setcookie("token", $value, [
"expires" => time() + 3600,
"path" => "/",
"domain" => "example.com",
"secure" => true, // HTTPS only
"httponly" => true, // no JS access
"samesite" => "Lax", // CSRF protection
]);
// php.ini equivalents:
// session.cookie_secure = 1
// session.cookie_httponly = 1
// session.cookie_samesite = Lax Pro Tip
SameSite=Strict prevents any cross-site cookie sending; Lax allows top-level GET navigations.