title: PHP session cookies blocked by end user security software
body: <p>I have an issue with PHP session cookies which is affecting only users of Internet Explorer who are using security software including McAffee, AVG and Norton. Some (but apparently not all) users of IE and these security packages are unable to login or add items to their basket, as it appears the software is blocking the session cookie created by PHP. </p>
  
  <ul>
  <li>Using standard IE, Firefox, Opera et al. session cookies work as normal. </li>
  <li>Changing IE security settings to the max still allows the cookies through.</li>
  <li>Cookies are not encrypted.</li>
  <li>We do not have PCI compliance, but we do have an up-to-date EV SSL certificate.</li>
  <li>Cookies are created by a custom (third-party) session class. </li>
  <li>We have tried installing the software packages but have not been able to recreate the bug.</li>
  <li>We know from ecommerce conversion that this is affecting only/mainly IE users. </li>
  </ul>
  
  <p>The session is started using <code>session_start()</code> and we're defining the following settings for it: </p>
  
  <pre><code>@ini_set('session.use_cookies', 1); 
  @ini_set('session.use_trans_sid', 'Off'); 
  @ini_set('url_rewriter.tags', ''); 
  @ini_set('session.gc_probability', 1); 
  @ini_set('session.gc_divisor', 100); 
  @ini_set('session.referer_check', ''); 
  @ini_set('session.gc_maxlifetime', 604800); 
  session_set_cookie_params($this-&gt;session_lifespan, '/', null, null, TRUE); 
  session_start(); 
  </code></pre>
  
  <p>Session lifespan is set to 21600 (six hours)</p>
  
  <p>What could be the possible cause of the cookies being blocked? Are these security packages known for this and are there any coding workarounds? </p>