Uh oh!
There was an error while loading.Please reload this page.
- Notifications
You must be signed in to change notification settings - Fork9.7k
Adds support for the SameSite attribute in cookies.#19104
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
Uh oh!
There was an error while loading.Please reload this page.
Conversation
$sameSite can be set to false, "lax", or "strict".You can read about what the different modes do here:http://www.sjoerdlangkemper.nl/2016/04/14/preventing-csrf-with-samesite-cookie-attribute/
| * @param bool $secure Whether the cookie should only be transmitted over a secure HTTPS connection from the client | ||
| * @param bool $httpOnly Whether the cookie will be made accessible only through the HTTP protocol | ||
| * @param bool $raw Whether the cookie value should be sent with no url encoding | ||
| * @param bool|string $sameSite Whether the cookie will be available for cross-site requests |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
wouldn't$crossSite be more descriptive?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
It's good practice to adhere to the spec name, i.e.samesite =>setSameSite.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
string|null would be better thanstring|bool IMO (especially given thattrue is not a valid value for this argument)
| protected$secure; | ||
| protected$httpOnly; | ||
| private$raw; | ||
| protected$sameSite; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
should beprivate
| * @param bool $secure Whether the cookie should only be transmitted over a secure HTTPS connection from the client | ||
| * @param bool $httpOnly Whether the cookie will be made accessible only through the HTTP protocol | ||
| * @param bool $raw Whether the cookie value should be sent with no url encoding | ||
| * @param bool|null $sameSite Whether the cookie will be available for cross-site requests |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
string|null
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Whoops.
| $this->httpOnly = (bool)$httpOnly; | ||
| $this->raw = (bool)$raw; | ||
| if (!in_array($sameSite,array(self::SAMESITE_LAX,self::SAMESITE_STRICT,null))) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
You should passtrue as a third argument
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
see4223997
fabpot commentedJun 23, 2016
Thank you@iangcarroll. |
joergludwig commentedJun 19, 2017
I just spent two hours, trying to make use of the SameSite flag. What I did not know was, that Cookie allows setting of the flag, but Response::sendHeaders() does not handle it. Maybe Response should throw an Exception, that PHP does not yet support sending of the SameSite flag? |
xabbuh commentedJun 19, 2017
Please open a new issue if you think that something is not working as expected. |
ThomHurks commentedDec 5, 2017
Indeed, this "feature" is very misleading as the SameSite attribute is never even passed to |
joergludwig commentedDec 7, 2017
Btw: A simple workaround is to add the following line to your apache config: |
$sameSite can be set to false, "lax", or "strict".
You can read about what the different modes do here:http://www.sjoerdlangkemper.nl/2016/04/14/preventing-csrf-with-samesite-cookie-attribute/