session_set_cookie_params([ 'lifetime' => 0, 'path' => '/', 'secure' => false, // true only if HTTPS 'httponly' => true, 'samesite' => 'Lax' ]);