Configure session cookie security in GLPI

If you see the following warning in the requirements check while installing or updating GLPI (shown here as it appears in Spanish; in English it reads "Security configuration for sessions"):

Configuración de seguridad para sesiones
Asegurar de que se aplica la seguridad en las cookies de sesión.

This message may mean that session.cookie_secure is not enabled for the PHP version running GLPI. That attribute prevents the browser from sending the cookie over HTTP.

How to fix it

First check that the certificate is valid and that GLPI works fully over HTTPS. If you enable this setting while the website still uses HTTP, users may lose their session.

In cPanel > Select PHP Version > Options, open the application's effective version and enable session.cookie_secure when the option is available. This method avoids depending on the Apache handler.

If you need to limit the setting to the directory and the server supports PHP directives in .htaccess, make a copy of the file and add:

php_value session.cookie_secure on

A php_value directive does not work with every handler and can cause a 500 error. If that happens, remove it and set the option from the PHP selector or contact support.

After the change, start a new session and check in the browser's developer tools that the cookie has the Secure attribute. If GLPI also shows a warning about HttpOnly or SameSite, fix it separately: they are not the same setting.

AutoSSL only covers eligible names that pass its validation. Check the certificate and the HTTPS redirect before requiring secure cookies.

If the warning persists

Confirm that the change applies to the domain and the PHP version serving GLPI. PHP on the command line and PHP for the web can load different configurations. Repeat the requirements check and start a new session to inspect the cookie issued, not one saved before the change.

If a proxy terminates HTTPS, check how GLPI learns the original protocol. Do not change several directives at once or publish an unprotected phpinfo() page. Keep the previous value so you can revert if login breaks. GLPI requirements.