session.use_only_cookies

Session: session.use_only_cookies — This option forces PHP to fetch and use a cookie for storing and maintaining the session id. We encourage this operation as it's very helpful in combating session hijacking when not specifying and managing your own session id. It is not the be-all and end-all of session hijacking defense, but it's a good start.

Modifiability: INI_ALL - The session.use_only_cookies INI directive can be configured anywhere, including php.ini files, ini_set calls, Apache .htaccess files, per-directory .ini files, etc.

[Session]
session.use_only_cookies = 1