How to set httponly in php

How to set httponly in php: first find and open the "php.ini" file; then set the value of the "session.cookie_httponly" item to 1 or TRUE; then open it through the "setrawcookie" method.

Recommended: "PHP Video Tutorial"

PHP sets the HTTPONLY attribute of Cookie

httponly is Microsoft's extension to cookies. This is mainly to solve the problem that users' cookies may be stolen.

As we all know, when we log in to our mailbox or forum, the server will write some cookies to our browser. When we visit other pages next time, the browser will automatically transfer the cookie, so this is achieved Once you log in, you can see all the content that you need to log in to see. In other words, in essence, all login statuses are based on cookies! Assuming that the cookies we log in are obtained by others, there is a risk of exposing personal information! Of course, think about it, how can anyone else get the customer's cookies? That must be a malicious person's program running in the browser! If it is rogue software that is flying all over the world now, there is no way. httponly is not used to solve this situation. It is used to solve the problem of JavaScript accessing cookies in the browser. Just imagine, a flash program running in your browser can get your cookies!

SP1 of IE6 comes with support for httponly, so it is relatively safe.

Settings in PHP

PHP5.2 and above already support the setting of HttpOnly parameters, and also support the setting of global HttpOnly, which can be set in php.ini

 session.cookie_httponly =

Its value is 1 or TRUE to turn on the global Cookie HttpOnly attribute. Of course, it also supports turning it on in the code:

 <?php ini_set("session.cookie_httponly", 1); 
 // or session_set_cookie_params(0, NULL, NULL, NULL, TRUE); 
 ?>

Cookie operation function setcookie function and setrawcookie function also specifically add a seventh parameter to do this It is an HttpOnly option. The method to enable it is:

 setcookie("abc", "test", NULL, NULL, NULL, NULL, TRUE); 
 setrawcookie("abc", "test", NULL, NULL, NULL, NULL, TRUE);

For versions earlier than PHP5.1 and PHP4, you need to use the header function to work around it:

 <?php header("Set-Cookie: hidden=value; httpOnly"); ?>

The above is the detailed content of How to set httponly in php. For more information, please follow other related articles on the PHP Chinese website!