Skip to content

Chapter 14 of 38

Sessions and Cookies

Manage secure session identity, cookie flags, expiration, rotation, and storage.

42 minutes 10 quick checksBy Subha Prasad
Lesson 14 of 38Course navigation
0 completed0%
View course overview

Lesson content

Read, practise, then check your understanding

Cookies live on the client; sessions usually store state server-side and send a random identifier. Configure cookie behavior before session_start.

Practical example

<?php
session_set_cookie_params(['secure' => true, 'httponly' => true, 'samesite' => 'Lax']);
session_start();
session_regenerate_id(true);
$_SESSION['user_id'] = $userId;

Rotate IDs after authentication/privilege changes, enforce idle and absolute expiry, and prevent fixation. Secure requires HTTPS, HttpOnly blocks script access, and SameSite limits cross-site inclusion but does not replace CSRF protection. Store minimal state.

Knowledge check

Answer every question correctly to complete this chapter.

Which statement best describes session ID?
Which PHP term matches this description: A random identifier linking a client to server-side session state.
Which statement best describes session fixation?
Which PHP term matches this description: An attack forcing a victim to use an attacker-known session ID.
Which statement best describes HttpOnly?
Which PHP term matches this description: A cookie flag preventing ordinary JavaScript access.
Which statement best describes SameSite?
Which PHP term matches this description: A cookie policy limiting cross-site request inclusion.
Which statement best describes Secure?
Which PHP term matches this description: A cookie flag restricting transmission to HTTPS.

0 of 10 checks passed

Your progress is saved on this device.