Has anyone used the directive session.cookie_secure when also using
Zend_Captcha_Image? When enabled, every time I try to login it fails. Essentially
each request is treated as a new session, therefore failing the captcha verification even when I type it in correctly. I have been using Zend_Captcha_Image for several months without any problems and when the session.cookie_secure directive is removed, it works fine.
I have tried just using the session.cookie_secure directive in the php.ini
file. (this is not how I’m doing it now, but I included it here so you know).
Currently I’m calling Zend_Session::setOptions(array('cookie_httponly' => true, 'cookie_secure' => true )); in the application bootstrap. I have turned on & off resources.session.cookie_secure = true to no avail.
Does anyone have any ideas?
The
cookie_securesetting only works over SSL. Do not set it unless you have SSL enabled with a certificate on your sever. Usually, you would enable this for use on the production site and disable it on the development servers.