What potential impact does using localhost without HTTPS have on PHP session cookies and cross-site cookie handling?

When using localhost without HTTPS, PHP session cookies are vulnerable to interception and manipulation by malicious actors. This can lead to unauthorized access to sensitive user data stored in session variables. To mitigate this risk, it is recommended to use HTTPS even in local development environments. Additionally, setting the session cookie's "secure" attribute to true can help protect it from being transmitted over unsecured connections.

// Enable secure session cookie
ini_set('session.cookie_secure', 1);