I generally use this to start a new session

<?php
    session_start( [ 
        'name' => DEBUG ? 'SessionId' : '__Secure-SessionId',
        'cookie_lifetime' => 0,
        'cookie_path' => '/',
        'cookie_secure' => true,
        'cookie_httponly' => true,
        'cookie_samesite' => 'Strict',
        'sid_length' => 96,
        'sid_bits_per_character' => 5,
        'use_strict_mode' => true,
        'referer_check' => $_SERVER['HTTP_HOST'],
    ] );
?>

which will create a session with increased entropy in the session cookie name, requires a secure session, make sure roque refers have no chance at my logon page among other things.

According to MDN[1] prefix "__Secure-" must be set for secure sessions.

[1](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie)