note 88123 added to function.session-start

When using session_start() with cookies over an encrypted connection (like HTTPS) it is important to set php_ini('session.cookie_secure',true). This sets a flag in the cookie which will stop browsers from sending this cookie over an unsecured connection. If this is not done, a Man-In-The-Middle could easily cause the victim's browser to send his session ID in plaintext, gaining access to the account and defeating the goal of the secure connection. http://fscked.org/blog/fully-automated-active-https-cookie-hijacking ---- Server IP: 69.147.83.197 Probable Submitter: 69.196.152.18 ---- Manual Page -- http://www.php.net/manual/en/function.session-start.php Edit -- https://master.php.net/note/edit/88123 Del: integrated -- https://master.php.net/note/delete/88123/integrated Del: useless -- https://master.php.net/note/delete/88123/useless Del: bad code -- https://master.php.net/note/delete/88123/bad+code Del: spam -- https://master.php.net/note/delete/88123/spam Del: non-english -- https://master.php.net/note/delete/88123/non-english Del: in docs -- https://master.php.net/note/delete/88123/in+docs Del: other reasons-- https://master.php.net/note/delete/88123 Reject -- https://master.php.net/note/reject/88123 Search -- https://master.php.net/manage/user-notes.php