Support cookie prefixes in session name

Cookies can be marked with a prefix to receive certain security features in browsers. Specifically, cookies can be prefixed with __Host- or __Secure-. To use this for the PHP session ID, you would do something like this:

session_start([name => '__Host-PHPSESSID']);

Or configure a similar cookie name in the php.ini. This works as expected: sessions still work and the cookie is marked as host-only.

The problem is that the documentation says that the cookie name should be alphanumeric, and _ and - are not alphanumeric. So according to the docs the above is not supported.

• PHP: session_name - Manual: "It should contain only alphanumeric characters"
• PHP: Runtime Configuration - Manual: "It should only contain alphanumeric characters."

I would like to see the documentation for session_name to be changed, so that cookie prefixes are considered acceptable.

Start with the linked PHP manual pages for session_name and the session.name configuration directive. Update the documented character restrictions to address __Host- and __Secure- cookie prefixes, and verify that both pages describe the supported naming consistently.