The settings are described as:

1. If <true> cookie will only be sent over secure connections.
2. - PHP setting: session.cookie_secure
   #CookieSecure=false|true
3. Tells browser to not allow scripts to access cookie, only supported on php 5.2+
4. - PHP setting: session.cookie_httponly
   #CookieHttponly=false|true

but they do not work. if the settings have a value other than 0 or empty, they are always treated as true. even using the description and defining Setting=false, will give a behavior of true.

Steps to reproduce

set any of those settings to any string you like. they will all be treated as true.

put the setting to false, it will not work.