# [SECURITY] http header의 cookie

<table id="bkmrk-%EC%BF%A0%ED%82%A4-%EC%9D%B4%EB%A6%84-%EC%97%AD%ED%95%A0-secure-%ED%94%8C%EB%9E%98%EA%B7%B8-" style="width: 82.5926%;"><thead><tr><th style="width: 25.1672%;">**쿠키 이름**</th><th style="width: 27.0784%;">**역할**</th><th style="width: 26.6467%;">**Secure** 플래그</th><th style="width: 21.1078%;">**HttpOnly** 플래그</th></tr></thead></table>

<table id="bkmrk-phpsessid-php-%EA%B8%B0%EB%B3%B8-%EC%84%B8%EC%85%98-" style="width: 82.4691%;"><tbody><tr><td style="width: 25.7871%;">`PHPSESSID`</td><td style="width: 26.6867%;">PHP 기본 세션 쿠키</td><td style="width: 26.3882%;">**적용 안됨**</td><td style="width: 21.1381%;">**적용 안됨**</td></tr></tbody></table>

<table id="bkmrk-xsrf-token-csrf-%EB%B3%B4%ED%98%B8%EB%A5%BC-" style="width: 82.716%;"><tbody><tr><td style="width: 25.8595%;">`XSRF-TOKEN`</td><td style="width: 26.7564%;">CSRF 보호를 위한 토큰</td><td style="width: 26.1607%;">적용됨</td><td style="width: 21.2235%;">**적용 안됨**</td></tr></tbody></table>

<table id="bkmrk-laravel-%EC%84%B8%EC%85%98-%EC%BF%A0%ED%82%A4%3A-larav" style="width: 82.963%;"><tbody><tr><td style="width: 25.7824%;">`Laravel 세션 쿠키:`</td><td style="width: 27.4218%;">Laravel 세션 쿠키</td><td style="width: 25.6356%;">적용됨</td><td style="width: 21.1602%;">적용됨</td></tr></tbody></table>

XSRF-ROKEN과 Laravel 세션 쿠키는 프론트에서 처리 가능

> ## **PHPSESSID의 Secure 플래그 추가 방법**

- #### **`php.ini` 설정 수정**
    
    <div class="contain-inline-size rounded-md border-[0.5px] border-token-border-medium relative bg-token-sidebar-surface-primary dark:bg-gray-950"><div class="sticky top-9 md:top-[5.75rem]">  
    </div><div class="overflow-y-auto p-4" dir="ltr">`<span class="hljs-attr">session.cookie_secure</span> = <span class="hljs-literal">On</span>`</div></div>
- #### **PHP 코드에서 설정  
    `session_start()`를 호출하기 전에 아래와 같이 설정합니다:
    
    <div class="contain-inline-size rounded-md border-[0.5px] border-token-border-medium relative bg-token-sidebar-surface-primary dark:bg-gray-950"><div class="sticky top-9 md:top-[5.75rem]">  
    </div><div class="overflow-y-auto p-4" dir="ltr">`<span class="hljs-title function_ invoke__">ini_set</span>(<span class="hljs-string">'session.cookie_secure'</span>, <span class="hljs-number">1</span>);<span class="hljs-title function_ invoke__">ini_set</span>(<span class="hljs-string">'session.cookie_httponly'</span>, <span class="hljs-number">1</span>); <span class="hljs-comment">// HttpOnly 추가</span><span class="hljs-title function_ invoke__">session_start</span>();`</div></div>
- #### **`.htaccess` 파일에서 설정**
- `.htaccess`를 사용하여 PHP 설정을 수정할 수 있습니다:
    
    <div class="contain-inline-size rounded-md border-[0.5px] border-token-border-medium relative bg-token-sidebar-surface-primary dark:bg-gray-950"><div class="sticky top-9 md:top-[5.75rem]">  
    </div><div class="overflow-y-auto p-4" dir="ltr">`php_value session.cookie_secure On`</div><div class="overflow-y-auto p-4" dir="ltr">`php_value session.cookie_httponly On`</div></div>