A PHP session hardening flag is turned off at runtime with ini_set(): session.cookie_httponly, session.cookie_secure, or session.use_only_cookies set to 0 / '0' / false.

Why this matters

This exposes the session cookie to JavaScript (XSS), lets it travel over plain HTTP, or allows the session id in the URL to be accepted (CWE-1004). AI-generated code flips these off to work around a local setup and the weakened configuration ships.

Enable them instead (or set them in php.ini): ini_set('session.cookie_httponly', 1); ini_set('session.cookie_secure', 1); ini_set('session.use_only_cookies', 1);

<?php

function harden_session_wrong()
{
    // ruleid: auth.php.session.insecure-ini
    ini_set('session.cookie_httponly', 0);

    // ruleid: auth.php.session.insecure-ini
    ini_set('session.cookie_secure', '0');

    // ruleid: auth.php.session.insecure-ini
    ini_set('session.use_only_cookies', false);
}

<?php

function harden_session()
{
    // ok: session cookie kept HttpOnly
    ini_set('session.cookie_httponly', 1);

    // ok: session cookie kept Secure
    ini_set('session.cookie_secure', 1);

    // ok: session id only accepted from cookies
    ini_set('session.use_only_cookies', 1);
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.php.session.insecure-ini -- <reason>

References