PHP session.cookie_secure实际上并没有将cookie设置为安全

Question

In my php.ini confirmed I have:

session.cookie_secure = 1

Also, doing:

<?php print_r(session_get_cookie_params()); ?>

Results in:

Array ( [lifetime] => 0 [path] => / [domain] => [secure] => 1 [httponly] => 1 )

However, inspecting a page in my application with Chrome Developer tools, going to cookies, it lists that sessions cookie is not secure, and not http only.

Answer 1

Similar to my answer in another question , Chrome developer tools always show blank Secure and HTTP attributes when the cookie is sent in the request. This is because the fact that a cookie is secure or HTTP only is not actually sent in a HTTP request. All that is sent is the name/value pair in the Cookie HTTP request header:

Cookie: name=value

Try an extension such as Edit This Cookie which will show whether the cookie has been successfully set as secure and HTTP Only.