0

So I am using this legacy application which is in php 4. I am trying to set the httponly flag and secure flag on.

This is my code:

header( "Set-Cookie:". $cookieName."=".$sessId."; expires=".$expireSeconds."; sessionID=".$sessId.";path=".$path."; domain=".$domain."; httponly; secure");

The secure flag is set on but the httponly is not.

Could it because the URL uses https protocol?

EDIT: Also, does the expire field take seconds. right now, $expireSeconds=14400; How do I modify the code to rectify this if it doesnt expect seconds as a parameter.

Micheal
  • 2,272
  • 10
  • 49
  • 93

1 Answers1

0

Why are you doing it via header() when there's setcookie() available? This function is available in PHP4.

setcookie($cookieName, $sessID, $expireSeconds, $path, $domain, true, true);
                                                                ^--secure
                                                                      ^--http
Marc B
  • 356,200
  • 43
  • 426
  • 500