@@ -426,20 +426,19 @@ Preference Default Opti
426426 (often the default value of ``1440 ``). This needs to be changed in
427427 ``php.ini `` or via ``ini_set() `` as needed.
428428
429- In addition to the values above, the cookie and native drivers apply the
430- following configuration values shared by the :doc: `IncomingRequest </incoming/incomingrequest >` and
431- :doc: `Security <security >` classes:
429+ In addition to the values above, the Session cookie uses the
430+ following configuration values in your **app/Config/Cookie.php ** file:
432431
433- ==================== =============== ===========================================================================
432+ ============== =============== ===========================================================================
434433Preference Default Description
435- ==================== =============== ===========================================================================
436- **cookieDomain ** '' The domain for which the session is applicable
437- **cookiePath ** / The path to which the session is applicable
438- **cookieSecure ** false Whether to create the session cookie only on encrypted (HTTPS) connections
439- **cookieSameSite ** Lax The SameSite setting for the session cookie
440- ==================== =============== ===========================================================================
441-
442- .. note :: The 'cookieHTTPOnly' setting doesn't have an effect on sessions.
434+ ============== =============== ===========================================================================
435+ **domain ** '' The domain for which the session is applicable
436+ **path ** / The path to which the session is applicable
437+ **secure ** false Whether to create the session cookie only on encrypted (HTTPS) connections
438+ **sameSite ** Lax The SameSite setting for the session cookie
439+ ============== =============== ===========================================================================
440+
441+ .. note :: The ``httponly`` setting doesn't have an effect on sessions.
443442 Instead the HttpOnly parameter is always enabled, for security
444443 reasons. Additionally, the ``Config\Cookie::$prefix `` setting is completely
445444 ignored.
0 commit comments