0Pricing
PHP Academy · Lesson

Cookie Security: HttpOnly and Secure Flags

Protect cookies with HttpOnly, Secure, and SameSite attributes.

The HttpOnly Flag

When a cookie has the HttpOnly flag, JavaScript cannot access it via document.cookie, preventing XSS-based session theft.

Setting HttpOnly and Secure

Use the options array form (PHP 7.3+) for clean, readable code.

<?php
setcookie("session_id", $id, [
    "expires"  => time() + 3600,
    "path"     => "/",
    "secure"   => true,
    "httponly" => true,
    "samesite" => "Strict",
]);

All lessons in this course

  1. Starting and Using Sessions
  2. Session Security Best Practices
  3. Setting and Reading Cookies
  4. Cookie Security: HttpOnly and Secure Flags
← Back to PHP Academy