note 73818 added to function.session-set-cookie-params

It would seem that session_set_cookie_params will still set a cookie via HTTP, even if the secure parameter is true. So even if your site uses HTTPS/SSL to communicate sensitive data, if the initial session cookie was set by PHP's session module via HTTP, an attacker listening on the wire could easily spoof a visitor's cookie and gain access to their session. See: http://bugs.php.net/bug.php?id=40778 ---- Server IP: 216.194.113.175 Probable Submitter: 69.238.96.156 ---- Manual Page -- http://www.php.net/manual/en/function.session-set-cookie-params.php Edit -- https://master.php.net/note/edit/73818 Del: integrated -- https://master.php.net/note/delete/73818/integrated Del: useless -- https://master.php.net/note/delete/73818/useless Del: bad code -- https://master.php.net/note/delete/73818/bad+code Del: spam -- https://master.php.net/note/delete/73818/spam Del: non-english -- https://master.php.net/note/delete/73818/non-english Del: in docs -- https://master.php.net/note/delete/73818/in+docs Del: other reasons-- https://master.php.net/note/delete/73818 Reject -- https://master.php.net/note/reject/73818 Search -- https://master.php.net/manage/user-notes.php