Rename session cookie to something else, than PHPSESSID

Question

I am reading through the suggested php.ini changes from https://github.com/h5bp/html5-boilerplate/blob/master/.htaccess

One of the suggestions is:

# Rename session cookie to something else, than PHPSESSID
php_value session.name sid

I am interested to know how this could effect my current websites and how this would improve security?

Answer 1

By changing the name, the only security improvement you will have is that you will no longer expose that you are using PHP via the cookie name.

If you change this value, the only side effect on your website is that all the currently logged-in users will became logged-out.

Plus, you can use a fun name, like we_are_hiring_ninjas !

Answer 2

The name of the session cookie can be changed from the php.ini file and also from the host definition on Apache config.

Take a look there.

All the best.