Hardening PHP Session Security Against Hijacking

PHP’s default session configuration is reasonable but not hardened — a few settings changes meaningfully reduce the risk of session hijacking on any application handling logins.

ini_set('session.cookie_httponly', 1); // JS can't read the session cookie
ini_set('session.cookie_secure', 1);   // only sent over HTTPS
ini_set('session.cookie_samesite', 'Lax'); // CSRF mitigation
ini_set('session.use_strict_mode', 1); // reject uninitialized session IDs

session_start();

// Regenerate the session ID after login - prevents session fixation
function loginUser(int $userId): void {
    session_regenerate_id(true);
    $_SESSION['user_id'] = $userId;
    $_SESSION['login_time'] = time();
}

Session Timeout

$timeout = 1800; // 30 minutes
if (isset($_SESSION['login_time']) && (time() - $_SESSION['login_time']) > $timeout) {
    session_unset();
    session_destroy();
}
$_SESSION['login_time'] = time(); // refresh on activity