session_start();

$secure = !empty($_SERVER['HTTPS']);

session_set_cookie_params([
    'secure'   => $secure,
    'httponly' => true,
    'samesite' => 'Strict'
]);