Cookies can be marked with a prefix to receive certain security features in browsers. Specifically, cookies can be prefixed with __Host- or __Secure-. To use this for the PHP session ID, you would do something like this:
session_start([name => '__Host-PHPSESSID']);
Or configure a similar cookie name in the php.ini. This works as expected: sessions still work and the cookie is marked as host-only.
The problem is that the documentation says that the cookie name should be alphanumeric, and _ and - are not alphanumeric. So according to the docs the above is not supported.
I would like to see the documentation for session_name to be changed, so that cookie prefixes are considered acceptable.
Cookies can be marked with a prefix to receive certain security features in browsers. Specifically, cookies can be prefixed with
__Host-or__Secure-. To use this for the PHP session ID, you would do something like this:Or configure a similar cookie name in the php.ini. This works as expected: sessions still work and the cookie is marked as host-only.
The problem is that the documentation says that the cookie name should be alphanumeric, and
_and-are not alphanumeric. So according to the docs the above is not supported.I would like to see the documentation for
session_nameto be changed, so that cookie prefixes are considered acceptable.