title: creating secure php session cookies
body: <p>I'm trying to get the php session cookie where the php session id is stored to be secure(https) and http only.</p>
  
  <pre><code>$name = session_name();
  setcookie($name, $_COOKIE[$name], 0, '/', 'domain.com, 1, 1);
  </code></pre>
  
  <p>I call the above code before session start. The problem is that it creates two cookies. A secure one the way I want it, and then it creates a regular cookie with no ssl or http-only. Both cookies have the same value.</p>
  
  <p>Is there a way to tell php to create secure(ssl) and http-only session cookies?</p>
  
  <p>Also, instead of making another question. Since we're on the same topic... Can a user modify <code>$_SESSION</code> variables on their end? I know they can manipulate the session id on their end, but was wondering if <code>$_SESSION</code> is secure to store a userid which the end-user can't modify on their will.</p>