From f0397bbc59f0b51b70ddba7d5ccddefc768bb72c Mon Sep 17 00:00:00 2001
From: Robert Elder <robert@robertelder.org>
Date: Mon, 29 Sep 2014 18:22:10 +0000
Subject: [PATCH] PHP ini settings for cookies.

---
 airtime_mvc/public/index.php | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/airtime_mvc/public/index.php b/airtime_mvc/public/index.php
index 7c6d5cfb4..5fcfa36d7 100644
--- a/airtime_mvc/public/index.php
+++ b/airtime_mvc/public/index.php
@@ -1,5 +1,15 @@
 <?php
 
+//  Only enable cookie secure if we are supporting https.
+//  Ideally, this would always be on and we would force https,
+//  but the default installation configs are likely to be installed by
+//  amature users on the setup that does not have https.  Forcing
+//  cookie_secure on non https would result in confusing login problems.
+if(!empty($_SERVER['HTTPS'])){
+        ini_set('session.cookie_secure', '1');
+}
+ini_set('session.cookie_httponly', '1');
+
 error_reporting(E_ALL|E_STRICT);
 
 function exception_error_handler($errno, $errstr, $errfile, $errline)