title: Rename PHP session cookie with __Secure-/__Host- prefix
body: <p>I'm trying to rename my PHP session cookie from <code>PHPSESSID</code> to <code>__Secure-PHPSESSID</code> as per <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#Examples" rel="nofollow noreferrer">https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#Examples</a>.</p>
  
  <p>Since PHP does not offer this mechanism, I am doing it through Apache server configuration:</p>
  
  <pre><code>RequestHeader edit Cookie ^__Secure-PHPSESSID(.*)$ PHPSESSID$1
  Header edit Set-Cookie ^PHPSESSID(.*)$ __Secure-PHPSESSID$1
  Header edit Set-Cookie ^(.*)(?&lt;!SameSite=Strict)(?&lt;!SameSite=Lax)$ "$1;SameSite=Lax"
  </code></pre>
  
  <p>This works correctly in Firefox, Edge, and Safari, but not Chrome. On Chrome, I can see that the cookie is set with the correct name and flags but I cannot log in to my site.</p>
  
  <p>Upon login, the output of <code>var_dump($_SESSION['internal']['user_name'])</code> is <code>NULL</code> on Chrome but shows the correct username on Firefox and other browsers. I can also see that the session ID is being regenerated every time I try to log in and the value is set in the <code>__Secure-PHPSESSID</code> cookie.</p>
  
  <p>I tried removing the <code>SameSite</code> flag (line 3 above) and it still does not work.</p>
  
  <p>Any ideas?</p>