Cookie Security: HttpOnly and Secure Flags
Protect cookies with HttpOnly, Secure, and SameSite attributes.
Cookie Security: HttpOnly and Secure Flags is a free PHP Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the PHP Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
The HttpOnly Flag
When a cookie has the HttpOnly flag, JavaScript cannot access it via document.cookie, preventing XSS-based session theft.
Setting HttpOnly and Secure
Use the options array form (PHP 7.3+) for clean, readable code.
<?php
setcookie("session_id", $id, [
"expires" => time() + 3600,
"path" => "/",
"secure" => true,
"httponly" => true,
"samesite" => "Strict",
]);The Secure Flag
A Secure cookie is only sent over HTTPS. On HTTP connections the browser omits it, preventing interception over plain HTTP.
The SameSite Attribute
SameSite controls when cookies are sent with cross-site requests:
Strict— only same-site requestsLax— same-site + top-level navigationsNone— cross-site (requires Secure)
SameSite and CSRF
Setting SameSite to Strict or Lax mitigates CSRF because the session cookie is not sent with forged cross-site POST requests.
php.ini Session Cookie Settings
Configure default session cookie security at runtime:
<?php
ini_set("session.cookie_httponly", "1");
ini_set("session.cookie_secure", "1");
ini_set("session.cookie_samesite", "Lax");
session_start();Cookie Prefixes
Browsers honour cookie name prefixes:
__Secure-— cookie must have Secure flag__Host-— must have Secure, Path=/, no Domain attribute
Cookie Prefix Example
Use the __Host- prefix to bind a cookie to the exact host.
<?php
setcookie("__Host-session", $token, [
"secure" => true,
"httponly" => true,
"samesite" => "Strict",
"path" => "/",
]);Reviewing Flags in DevTools
In browser DevTools → Application → Cookies, verify: HttpOnly ticked, Secure ticked, SameSite shows Strict or Lax.
Without HttpOnly
A malicious script injected via XSS can run document.cookie, read the session ID, and send it to an attacker — taking over the account.
Without Secure
On a mixed HTTP/HTTPS site, the session cookie is sent in plain text over HTTP. A network eavesdropper can steal it.
Summary
Always set HttpOnly and Secure on session and authentication cookies. Add SameSite=Strict or Lax. Use the options-array form of setcookie().
Quick Check
Which flag prevents JavaScript from reading a cookie?
Frequently asked questions
Is the “Cookie Security: HttpOnly and Secure Flags” lesson free?
Yes — the full text of “Cookie Security: HttpOnly and Secure Flags” is free to read here on the web, and the PHP Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the PHP Academy course, upgrade to CoddyKit PRO.
What will I learn in “Cookie Security: HttpOnly and Secure Flags”?
Protect cookies with HttpOnly, Secure, and SameSite attributes. You practise PHP Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start PHP Academy?
No prior experience is required. PHP Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Cookie Security: HttpOnly and Secure Flags” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this PHP Academy lesson?
Yes. Every PHP Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Starting and Using Sessions
- Session Security Best Practices
- Setting and Reading Cookies
- Cookie Security: HttpOnly and Secure Flags