13

I only manually set one cookie on my social network site, but I rely heavily on php sessions. I am wondering if sessions set any cookies behind the scenes?

I was just reading up on HttpOnly-cookies and I am just trying to figure out if I can use them.

Ben Visness
  • 5,729
  • 1
  • 20
  • 31
JasonDavis
  • 48,204
  • 100
  • 318
  • 537

4 Answers4

23

PHP sessions can use cookies depending on how you configure them. Have a look at these settings:

  • session.use_cookies (boolean): specifies whether the module will use cookies to store the session id on the client side. Defaults to 1 (enabled).
  • session.use_only_cookies (boolean): specifies whether the module will only use cookies to store the session id on the client side. Enabling this setting prevents attacks involved passing session ids in URLs. This setting was added in PHP 4.3.0. Defaults to 1 (enabled) since PHP 5.3.0.

If you disable session cookies, a GET parameter is used instead.

Ayman Hourieh
  • 132,184
  • 23
  • 144
  • 116
  • I kinda of thought this is what happened but now I know, thanks. My system does use the cookie method for storing a session id. Is this cookie secure? – JasonDavis Sep 04 '09 at 01:23
  • 1
    What do you mean by "secure"? The cookie method is more secure than passing session IDs in URLs. However, this does not mean that they are 100% secure. For example, if your website is vulnerable to XSS, it may be possible for attackers to steal session cookies. – Ayman Hourieh Sep 04 '09 at 01:30
4

Yes. PHP sessions rely on a cookie containing a session key. Your session data are stored only on your server, but a unique ID is assigned to each session and that ID gets saved in a cookie.

What relationship do you see between a session cookie and a traditional cookie set as HttpOnly?

Also: keep in mind that HttpOnly is not supported across all browsers.

VoteyDisciple
  • 37,319
  • 5
  • 97
  • 97
4

It does, there's a cookie named PHPSSID that stores the session ID.

For HttpOnly cookies, see http://ilia.ws/archives/121-httpOnly-cookie-flag-support-in-PHP-5.2.html

-6

PHP sessions use HTTP to get and set the session ID, and the filesystem to store the sessions - no cookies are used at any point unless you actually create them using setcookie();

Jamie

Jamie Rumbelow
  • 4,967
  • 2
  • 30
  • 42