LiteSpeed Alternative to Apache Header Edit

LiteSpeed doesn't support Apache's header edit directive, and so the following Apache directive won't work on LiteSpeed:

Header always edit Set-Cookie (.*) "$1;HTTPOnly;Secure;SameSite=none"

This particular case, which involves patching Set-Cookie with a secure flag when served over HTTPS, is automatically handled by LiteSpeed Web Server as of v5.4.5, and so it is unnecessary to use a directive for that.

For HTTPOnly settings, you should be able to use php.ini. For example:

  session.cookie_httponly=On
 

Starting from 5.4.9 build 2, a new directive ForceSecureCookie has been introduced to enforce “secure” and “SameSite” cookie attributes. It can be set in the Apache config file at the server or virtual host level, or in .htaccess of the document root directory.

ForceSecureCookie can use value

off, on|secure, lax|same_site_lax, strict|same_site_strict, same_site_none

same_site_xxxx value can be combined with secure.

For example: To enforce secure attribute only:

ForceSecureCookie secure

To enforce “secure; SameSite=none;” attribute:

ForceSecureCookie secure same_site_none

To enforce “SameSite=strict” attribute only

ForceSecureCookie strict

or

ForceSecureCookie same_site_strict

When using the above directives, please make sure to enclose with

<IfModule LiteSpeed>
...
</IfModule>