Description:
------------
Using session_set_cookie_params() to enable "secure" cookies, PHP will set a cookie with the secure flag, but does not check if the session_start() occurred over a secure connection to begin with.

This creates two problems:

1. The SessionID is translated in the clear to the browser, which defeats the purpose of secure SSL-only Session cookies.

2. Since the cookie is set to secure, it is not submitted when the page is refreshed or another non-SSL page is navigated to. This is correct, but the result is PHP does not get the cookie and PHP re-issues a new session ID cookie, which it then again, submits over plain text. When switching between SSL and non-SSL, this can silently create all sorts of session oddities.

The user can solve this by wrapping the session setup in a block that checks if SSL is enabled, but if the user does not realize this, they may think they are setting up a secure cookie, when in fact they end of with a cookie that is transferred in the clear and reset on each non-SSL page.

Test script:
---------------
// Run over a non SSL connection:
session_set_cookie_params(0,'/','domain.com',true,true);
session_start();

Expected result:
----------------
I think this should throw at least a warning if not a fatal exception.

Either refuse to create the session and create a warning: "Session was not created. You asked for a secure session cookie but this page is running over an unsecured connection".

OR

"Fatal Error: Cannot start secure session over an insecure connection"

Actual result:
--------------
From above:


1. The SessionID is translated in the clear to the browser, which defeats the purpose of secure SSL-only Session cookies.

2. Since the cookie is set to secure, it is not submitted when the page is refreshed or another non-SSL page is navigated to. This is correct, but the result is PHP does not get the cookie and PHP re-issues a new session ID cookie, which it then again, submits over plain text. When switching between SSL and non-SSL, this can silently create all sorts of session oddities.