Modifying other php.ini params

[juanluisbaptiste]

Hi David how are ya ? happy new year !!

Last week I had to do a security audit of some sites and on the report, a couple issues came along that to fix them a couple options in php.ini can me added. Their about cookie security, the httpOnly set-cookie response header and secure cookie attribute.

They can be configured by setting the session.http_only and session.cookie_secure respectively in php.ini.

What do you think about this ? could it be possible to have some options to increase security and enable this parameters ?

Thanks.