Sessions and Cookies

PHP sessions store a session ID in a cookie and data on the server (files by default; Redis or a database when running multiple servers). Harden them with session.cookie_secure=1, session.cookie_httponly=1, session.cookie_samesite=Lax, session.use_strict_mode=1 and session.use_only_cookies=1. Regenerate the ID on privilege changes, set idle and absolute timeouts, and destroy the session fully on logout.

<?php
session_set_cookie_params([
    'lifetime' => 0,
    'path' => '/',
    'secure' => true,
    'httponly' => true,
    'samesite' => 'Lax',
]);
ini_set('session.use_strict_mode', '1');
session_start();

// Logout
$_SESSION = [];
$params = session_get_cookie_params();
setcookie(session_name(), '', ['expires' => time() - 3600] + $params);
session_destroy();

Common pitfalls

• File-based sessions behind a load balancer without sticky sessions — users get logged out randomly.
• Storing large objects in the session.
• Not invalidating the session server-side on logout.

Key points

• Secure, HttpOnly, SameSite cookies
• Shared session storage for multiple servers
• Regenerate on login; destroy on logout

Further reading: PHP manual: session security