If you're handling PHP sessions, don't ignore this:

`lifetime` → how long the session lives
`domain` → who can use it
`path` → where it applies
`secure` → HTTPS only
`httponly` → out of JS reach
`samesite` → CSRF defense

small details, big differences.

#php #session #csrf #https