title: Zend Framework 1: Setting Session Cookie to Http-Only is not working
body: <p>So, at this very old project where there is still ZF1 running, we tried to put the http-only flag of the session-cookie to TRUE.</p>
  <p>We already have this line in the application.ini: <code>phpSettings.session.cookie_httponly = true</code></p>
  <p>Then we went to the Session.php of the Framework itself. In line 106, there's the setting for <code>cookie_httponly</code>, as seen here: <a href="https://github.com/zendframework/zf1/blob/master/library/Zend/Session.php" rel="nofollow noreferrer">https://github.com/zendframework/zf1/blob/master/library/Zend/Session.php</a></p>
  <p>Instead of <code>null</code>, we tried <code>'On'</code>, <code>'on'</code> and even <code>true</code>. We even set a breakpoint in line 205, and it went into the if-block during runtime.</p>
  <p>And yet, no matter how many times we delete the session cookie in the browser, there is NO flag shown under HttpOnly when the cookie is created again.</p>
  <p>We also have <code>Zend_Session::setOptions(array('cookie_httponly' =&gt; true));</code> in the code, as seen here in the index.php:</p>
  <pre><code>[...]
  /** Zend_Application */
  require_once 'Zend/Application.php';
  
  // Create application, bootstrap, and run
  $application = new Zend_Application(
      APPLICATION_ENV,
      APPLICATION_PATH . '/configs/application.ini'
  );
  
  Zend_Session::setOptions(array('cookie_httponly' =&gt; true));
  
  $application-&gt;bootstrap('frontend')
          -&gt;run();
  </code></pre>
  <p>We got no clue what else we should try.</p>