PHP 8.0 PHP.ini syntax for session_set_cookie_params - php

Question

I'm configuring the php.ini file, trying to understand the proper syntax for the php.ini file and setting the session-set-cookie.params. First, it's not clear if the settings needs to be in quotes? Can someone please provide an example for proper syntax? My goal is I want to have session variables available across all sub-domains on my website. It also says, "...you need to call session_set_cookie_params() for every request and before session_start() is called." So basically, I need to
<?php
session_set_cookie_params()
session_start()
// PHP CODE HERE
?>
Right? Here's the webpage and php.ini code below what I've figured out thus far.
https://www.php.net/manual/en/function.session-set-cookie-params.php.
session_set_cookie_params(
int $lifetime_or_options,
string|null $path = null,
string|null $domain = null,
bool|null $secure = null,
bool|null $httponly = null
): bool
Here's my config file thus far.
session_set_cookie_params(
600 $lifetime_or_options,
$path = .mywebsite.com,
$domain = /,
$secure = null,
$httponly = null
): bool

Answer 1

It seems to me that you are not attempting to modify php.ini here (php.ini is a static server-wide config file loaded before PHP), but rather set PHP's ini values at runtime via PHP code. To that end, I think you're just misreading the function definition in the documentation a bit, as to how parameters are expressed.
In later versions of PHP (you're using 8 so that counts), it is best to pass the parameters as an array. This is as listed under Alternative signature available as of PHP 7.3.0 in the docs. When the docs mention the value $lifetime_or_options, they mean that parameter can either be an integer lifetime value (600) or an array of all the options as:
Bundle them in an array with []:
session_set_cookie_params([
'lifetime' => 600,
'path' => '/',
'domain' => '.yoursite.example.com',
'secure' => true,
'httponly' => true
]);
Note that I have set secure and httponly to true. httponly will prevent javascript from gaining access to the session cookie, which is appropriate most of the time. However, set secure to false if you need your session to work without SSL - when set true as I have it, the session cookie would only be transmitted over https.
I have also switched your path and domain values.
The other older way to express this is just to pass individual values directly as function parameters - that is the part I think you misunderstood in the docs.
session_set_cookie_params(600, '/', '.yoursite.example.com', true, true);
Note also that 600 is a very short lifetime for a session cookie, only ten minutes. You might need it to live longer.