Cookie across HTTP and HTTPS in PHP

Question

How can I set a cookie in PHP that is readable both in HTTP and HTTPS?

If this isn't possible, what can be done? Set two cookies?

Answer 1

Assuming your domain name remains the same except for the resource type, cookies in PHP (or any language) can be read from both HTTP and HTTPS.

e.g.:

http://www.example.com
https://www.example.com

In this example, the cookies will be readable from each other.

Answer 2

By default, a cookie can be read by both http and https at the same URL.

However, a server can optionally specify the 'secure' flag while setting a cookie this tells the browser to only send it over a secure channel, such as an SSL connection.

In this case the cookie will only be sent over https. A cookie not marked as secure will be sent over both http and https.