PHP error guide

Secure session cookie missing over HTTP: meaning and fix

warning other Affects: PHP 7.4–8.4 Last verified:

Error summary

Serve authenticated traffic over HTTPS and keep Secure enabled; do not weaken production cookies merely to make an HTTP development URL work.

What it means

Serve authenticated traffic over HTTPS and keep Secure enabled; do not weaken production cookies merely to make an HTTP development URL work.

What the error means

Browsers do not send a Secure cookie over plain HTTP, so a new session can appear on each insecure request.

Why PHP produces it

The application correctly marks the session cookie Secure while the browser accesses an http:// origin.

PHP version notes

The behavior described for Secure session cookie missing over HTTP applies to PHP 7.4–8.4 unless a narrower version is stated; exact wording can vary by SAPI and patch release.

Most common causes

  • Local development uses HTTP with production cookie settings.
  • TLS terminates at a proxy but the application constructs an HTTP URL.
  • A health check tests authenticated state over HTTP.

Minimal examples

BAD — reproduces the problem

php 
session_set_cookie_params(["secure" => false]); // production workaround

FIXED — safer pattern

php 
session_set_cookie_params(["secure"=>true, "httponly"=>true, "samesite"=>"Lax"]);

Step-by-step diagnosis

  1. Inspect the Set-Cookie header and browser cookie rejection reason.
  2. Confirm the visible URL scheme and trusted proxy configuration.
  3. Verify the next HTTPS request includes the cookie.

Fixes

Use HTTPS for the session

Keep Secure and redirect or bind the environment to HTTPS.

php 
session_set_cookie_params([
    "secure" => true,
    "httponly" => true,
    "samesite" => "Lax",
]);

Common mistakes when fixing it

  • Disabling Secure globally.
  • Trusting arbitrary forwarded-proto headers.
  • Debugging only server-side session files.

How to prevent it

  • Use HTTPS in development and production.
  • Configure trusted proxies narrowly.
  • Test cookie attributes in browser workflows.

Web server / environment notes

fpm, apache, docker. Cookie delivery is enforced by the browser based on the request scheme.

Tags: fpm,apache,docker

Categories