<p>How can I set the cookies in my <code>PHP apps</code> as <code>HttpOnly cookies</code>?</p>

[{'answer_id': 36880, 'author': 'Polsonby', 'author_id': 137, 'author_profile': 'https://Stackoverflow.com/users/137', 'pm_score': 3, 'selected': False, 'text': '<p>Explanation here from Ilia... 5.2 only though</p>\n\n<p><a href="http://ilia.ws/archives/121-httpOnly-cookie-flag-support-in-PHP-5.2.html" rel="noreferrer">httpOnly cookie flag support in PHP 5.2</a></p>\n\n<p>As stated in that article, you can set the header yourself in previous versions of PHP</p>\n\n<pre><code>header("Set-Cookie: hidden=value; httpOnly");\n</code></pre>\n'}, {'answer_id': 36882, 'author': 'Marius', 'author_id': 1585, 'author_profile': 'https://Stackoverflow.com/users/1585', 'pm_score': 3, 'selected': False, 'text': '<pre><code>&lt;?php\n//None HttpOnly cookie:\nsetcookie("abc", "test", NULL, NULL, NULL, NULL, FALSE); \n\n//HttpOnly cookie:\nsetcookie("abc", "test", NULL, NULL, NULL, NULL, TRUE); \n\n?&gt;\n</code></pre>\n\n<p><a href="http://ilia.ws/archives/121-httpOnly-cookie-flag-support-in-PHP-5.2.html" rel="noreferrer">Source</a></p>\n'}, {'answer_id': 36883, 'author': 'Re0sless', 'author_id': 2098, 'author_profile': 'https://Stackoverflow.com/users/2098', 'pm_score': 3, 'selected': False, 'text': '<p>You can specify it in the set cookie function <a href="http://uk.php.net/setcookie" rel="noreferrer">see the php manual</a></p>\n\n<pre><code>setcookie(\'Foo\',\'Bar\',0,\'/\', \'www.sample.com\'  , FALSE, TRUE);\n</code></pre>\n'}, {'answer_id': 36885, 'author': 'Cheekysoft', 'author_id': 1820, 'author_profile': 'https://Stackoverflow.com/users/1820', 'pm_score': 8, 'selected': True, 'text': '<ul>\n<li>For <strong>your cookies</strong>, see this answer.</li>\n<li>For <strong>PHP\'s own session cookie</strong> (<code>PHPSESSID</code>, by default), see <a href="https://stackoverflow.com/a/8726269/1820">@richie\'s answer</a></li>\n</ul>\n<p>The <a href="http://php.net/manual/en/function.setcookie.php" rel="noreferrer"><code>setcookie()</code></a> and <a href="http://php.net/manual/en/function.setrawcookie.php" rel="noreferrer"><code>setrawcookie()</code></a> functions, introduced the boolean <code>httponly</code> parameter, back in the dark ages of PHP 5.2.0, making this nice and easy. Simply set the 7th parameter to true, as per the syntax</p>\n<p><em>Function syntax simplified for brevity</em></p>\n<pre><code>setcookie(    $name, $value, $expire, $path, $domain, $secure, $httponly )\nsetrawcookie( $name, $value, $expire, $path, $domain, $secure, $httponly )\n</code></pre>\n<p>In PHP &lt; 8, specify <code>NULL</code> for parameters you wish to remain as default.</p>\n<p>In PHP &gt;= 8 you can benefit from using named parameters. See <a href="https://stackoverflow.com/a/64997399/1820">this question about named params</a>.</p>\n<pre><code>setcookie( $name, $value, httponly:true )\n</code></pre>\n<p>It is also possible using the older, lower-level <a href="http://php.net/manual/en/function.header.php" rel="noreferrer"><code>header()</code></a> function:</p>\n<pre><code>header( &quot;Set-Cookie: name=value; HttpOnly&quot; );\n</code></pre>\n<p>You may also want to consider if you should be setting the <code>Secure</code> parameter.</p>\n'}, {'answer_id': 55377, 'author': 'tqbf', 'author_id': 5674, 'author_profile': 'https://Stackoverflow.com/users/5674', 'pm_score': 4, 'selected': False, 'text': "<p>Be aware that HttpOnly doesn't stop cross-site scripting; instead, it neutralizes one possible attack, and currently does that only on IE (FireFox exposes HttpOnly cookies in XmlHttpRequest, and Safari doesn't honor it at all). By all means, turn HttpOnly on, but don't drop even an hour of output filtering and fuzz testing in trade for it.</p>\n"}, {'answer_id': 250458, 'author': 'Community', 'author_id': -1, 'author_profile': 'https://Stackoverflow.com/users/-1', 'pm_score': 4, 'selected': False, 'text': "<p>Note that PHP session cookies don't use <code>httponly</code> by default.</p>\n\n<p>To do that:</p>\n\n<pre><code>$sess_name = session_name();\nif (session_start()) {\n    setcookie($sess_name, session_id(), null, '/', null, null, true);\n}\n</code></pre>\n\n<p>A couple of items of note here:</p>\n\n<ul>\n<li>You have to call <code>session_name()</code>\nbefore <code>session_start()</code> </li>\n<li>This also\nsets the default path to '/', which\nis necessary for Opera but which PHP\nsession cookies don't do by default\neither.</li>\n</ul>\n"}, {'answer_id': 8726269, 'author': 'richie', 'author_id': 1105047, 'author_profile': 'https://Stackoverflow.com/users/1105047', 'pm_score': 7, 'selected': False, 'text': "<p>For PHP's own session cookies on Apache:<br>\nadd this to your Apache configuration or <code>.htaccess</code></p>\n\n<pre><code>&lt;IfModule php5_module&gt;\n    php_flag session.cookie_httponly on\n&lt;/IfModule&gt;\n</code></pre>\n\n<p>This can also be set within a script, as long as it is called before <code>session_start()</code>.</p>\n\n<pre><code>ini_set( 'session.cookie_httponly', 1 );\n</code></pre>\n"}, {'answer_id': 16781285, 'author': 'Marius', 'author_id': 2335501, 'author_profile': 'https://Stackoverflow.com/users/2335501', 'pm_score': 2, 'selected': False, 'text': "<p>You can use this in a header file.</p>\n\n<pre><code>// setup session enviroment\nini_set('session.cookie_httponly',1);\nini_set('session.use_only_cookies',1);\n</code></pre>\n\n<p>This way all future session cookies will use httponly.</p>\n\n<ul>\n<li>Updated.</li>\n</ul>\n"}, {'answer_id': 20081735, 'author': 'Mareg', 'author_id': 1117506, 'author_profile': 'https://Stackoverflow.com/users/1117506', 'pm_score': 2, 'selected': False, 'text': '<p>The right syntax of the php_flag command is</p>\n\n<pre><code>php_flag  session.cookie_httponly On\n</code></pre>\n\n<p>And be aware, just first answer from server set the cookie and here (for example You can see the "HttpOnly" directive. So for testing delete cookies from browser after every testing request.</p>\n'}, {'answer_id': 61391222, 'author': 'Hein', 'author_id': 13392025, 'author_profile': 'https://Stackoverflow.com/users/13392025', 'pm_score': 0, 'selected': False, 'text': '<p>A more elegant solution since <strong>PHP >=7.0</strong> </p>\n\n<pre><code>session_start([\'cookie_lifetime\' =&gt; 43200,\'cookie_secure\' =&gt; true,\'cookie_httponly\' =&gt; true]);\n</code></pre>\n\n<p><a href="https://www.php.net/manual/en/function.session-start.php" rel="nofollow noreferrer">session_start</a></p>\n\n<p><a href="https://www.php.net/manual/en/session.configuration.php#ini.session.use-strict-mode" rel="nofollow noreferrer">session_start options</a></p>\n'}, {'answer_id': 69456549, 'author': 'rei', 'author_id': 13674736, 'author_profile': 'https://Stackoverflow.com/users/13674736', 'pm_score': 0, 'selected': False, 'text': "<p>Solution <code>session_start(['cookie_lifetime' =&gt; 43200,'cookie_secure' =&gt; true,'cookie_httponly' =&gt; true]);</code></p>\n<p>Thanks Hein.</p>\n"}]
['https://Stackoverflow.com/questions/36877', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/3871/']