0

Where should session cookies options go? in session_start or session_set_cookie_params?

The documentation at php.net is a bit unclear one these as they don't mention session_set_cookie_params. Are the cookie paramenters in php.int and session_set_ cookie_params overwritten by the ones in sessions_start? Can I combine all settings (cookie and otherwise) in one call to session_start?

EDIT: What is the point of session_set_cookie_params if these can be nuked by whatever is specified in session_start?

Improve this question
6
  • 1
    php.net/manual/en/function.session-start.php: "options: If provided, this is an associative array of options that will override the currently set session configuration directives." - what is unclear about that?
    – C3roe
    Commented Sep 11, 2023 at 13:40
  • As the authors of php.net are not explicit on that at leatst not in php.net I can guess but not be sure by you assesment. I will add a note on php.net if you are sure.
    – theking2
    Commented Sep 11, 2023 at 13:44
  • 1
    "What is the point of session_set_cookie_params if these can be nuked by whatever is specified in session_start?" - session_set_cookie_params is simply "older", existed already before session_start would take any "options", that was only added in later PHP versions.
    – C3roe
    Commented Sep 11, 2023 at 13:47
  • I don't know if the German translation is up to date (translations often get outdated) but there're many ways to change configurations, what means there're a lot of combinations. It isn't practical to document them all explicitly.
    – Álvaro González
    Commented Sep 11, 2023 at 13:48
  • 2
    Regarding your follow-up question, backward compatibility aside, think of them as default values rather than rules to enforce.
    – Álvaro González
    Commented Sep 11, 2023 at 13:50

1 Answer 1

Reset to default
0

The function session_set_cookie_params can be considered obsolete as all settings can now (since PHP7) be set as part of the options array to session_start. (Source php.net)

To avoid clutter include the cookie settings in this options parameter.

An argument to still use the session_set_cookie_params function is to distinguish between session settings and cookie settings related to sessions.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.