"safe" parameter in session_set_cookie_params

Question

I am interested in learning more about the safe parameter of a function session_set_cookie_params().

Can you tell me how to use this correctly? If this function is executed on an insecure page (but on a server that has SSL), will it somehow send it securely or will I have to force SSL on the page, is this function executed from my own?

Answer 1

This means that the client will only send this cookie over a secure (HTTPS) connection. This means that you need to redirect the user to a secure URL so that the cookie is sent to the server.

You can set a secure cookie over an insecure connection, although you obviously shouldn't (otherwise the cookie value can be sniffed). Since a secure cookie can be altered by an insecure connection, you cannot trust that the cookie value was not corrupted by a third party that intercepted and modified the contents of an insecure HTTP request to your site. Therefore, depending on how you use the secure cookie, you may need to check its contents.