title: Session cookie not being set
body: <p>can't get php's $_SESSION to work on my local machine</p>
  
  <p>it's working just fine on a live server but it's not working on a local machine </p>
  
  <p>i have tried with apache and php on windows, apache and php on mac and apache and php on debian, none of them work ( my live server is also running debian 9, the same one i tried locally )</p>
  
  <p>in firefox' developer tools > network > headers i can see that php is sending the set-cookie but for some reason it's not being set ( no cookies in storage > cookies, and my script isn't working as it should when cookie is set ) </p>
  
  <p>i'm not using ssl/https and i have set "session.cookie_secure = 0 and off" but for some reason this is what the set-cookie header looks like: "Set-Cookie: PHPSESSID=XXXXX;path=/;HttpOnly;Secure", i don't think php should be setting the Secure flag since i explicitly disabled it in php.ini? </p>
  
  <p>and yes, every file that uses session functionality has a session_start() in it</p>
  
  <p>there are no apache/php errors whatsoever, i even have xdebug enabled</p>
  
  <p>tested using localhost, 127.0.0.1, 10.0.0.10 ( my lan ip ), and custom hostname, none work</p>
  
  <p>i'm out of ideas, tried everything i could think of</p>
  
  <p>works on a live debian 9 server with php 7.2 and default configuration</p>
  
  <p>doesn't work on a local debian 9 server with php 7.2 and default configuration</p>
  
  <p>doesn't work on windows with the same apache/php versions</p>
  
  <p>doesn't work on mac with apache 2.4 and php 7.3, not even with 
  session.cookie_secure=0 set</p>
  
  <p>checked for both apache and php errors, there are none</p>
  
  <p>used firefox' developer tools to see headers/cookies</p>
  
  <p>checked my code and made sure it has session_start() and everything else is correct</p>
  
  <p>i even tried manually setting the cookie with the secure flag set to false and again "Secure" is being set in Set-Cookie header, this was the code: </p>
  
  <pre class="lang-php prettyprint-override"><code>setcookie("PHPSESSID", "7nhqdim7uu2viae7vhhf9os5ue", 0, "/", "", false, false);
  </code></pre>
  
  <p>and here is the code i use for testing: </p>
  
  <pre class="lang-php prettyprint-override"><code>&lt;?php
  session_start();
  
  var_dump($_SESSION);
  
  if(isset($_POST['submit']))
  {
    $_SESSION['value'] = $_POST['example'];
    header('Location: /session.php'); // session.php is this file
  }
  
  if(isset($_SESSION['value']) &amp;&amp; $_SESSION['value'] == 'example')
  {
    echo "value is " . $_SESSION['value'] . '&lt;br&gt;';
  }
  ?&gt;
  &lt;form method="post"&gt;
    &lt;input type="text" name="example" value="example"&gt;
    &lt;input type="submit" name="submit" value="submit"&gt;
  &lt;/form&gt;
  </code></pre>