How do you set up use HttpOnly cookies in PHP

Setting an HttpOnly cookie in PHP is an effective method to enhance website security, as it helps prevent cookie theft during Cross-Site Scripting (XSS) attacks. The HttpOnly attribute, when applied to a cookie, prevents JavaScript from accessing these cookies via methods such as Document.cookie.

To set an HttpOnly cookie in PHP, you can use the setcookie() or setrawcookie() functions. Both functions include a parameter (the httponly flag) that specifies whether the cookie should be accessible only via HTTP(S) and not via client-side scripts.

Here is an example of setting an HttpOnly cookie:

php
// Set an HttpOnly cookie
setcookie("user", "username", time()+3600, "/", "", false, true);

In this example:

• The first parameter "user" is the cookie name.
• The second parameter "username" is the cookie value.
• The third parameter time()+3600 sets the expiration time, which is one hour from now.
• The fourth parameter "/" sets the cookie path.
• The fifth parameter is an empty string, indicating the cookie domain, which defaults to the current domain.
• The sixth parameter false indicates that the cookie is not restricted to secure HTTPS connections.
• The last parameter true sets the HttpOnly flag, meaning the cookie cannot be accessed by client-side scripts.

By implementing an HttpOnly cookie in this manner, you can enhance application security, particularly in mitigating XSS attacks, effectively reducing the risk of attackers accessing user sessions via JavaScript.