-
Notifications
You must be signed in to change notification settings - Fork 1.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Bug: Support for SameSite cookie setting missing #3442
Comments
Hmmm - digging further into this I see that RFC about this is not (yet) approved - https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-05 August 8 2020 seems to be the dead-line. |
hey i need help my cookie doesn't store anything after redirect but if I comment the redirect (return redirect()->to('/browse'); ) public function saveUserCookie() |
|
it say "Call to undefined method CodeIgniter\HTTP\RedirectResponse::withCookies() " |
That function is available in version 4.0.4 only, so you need to upgrade CodeIgniter to the latest version. |
I have been working on a PR for SameSite setting, but wrapping up I have some problems running the tests and I wonder if someone could help me out. Running phpunit it fails hard in the database tests:
|
Did you change other tests? Can you try this? |
I am not sure what to put in test class name. The tests I have added to are in API, HTTP and Session and they all run fine. I have updated MockAppConfig and MockCLIConfig. The tests failing are in CodeIgniter\Database\Live\SQLite\AlterTableTest::testDropForeignKeySuccess which I haven't touched. Could be my sqlite (installed via homebrew) that is flakey.
|
The test class name is the class name ending in |
OK, output:
|
Must be something in my setup or the database tests. I have just cloned the develop branch from github and it fails in the same way. |
The failing tests are irrelevant in your case, I think. Maybe the Travis test will be the official judge for this. |
Yeah - thought so too, but that means I have to create the PR, right? |
Yes, to have it officially tested. |
...scary... ;-) I'll finish it up and create the PR. |
Seems like session mock wasn't correct. Now all tests pass. |
You all need to read this article I just found: This can now be set in the php ini file the above will show how to do it. |
If you're referring to the Also, this article seems a bit outdated since setting custom cookies with |
From what I read on PHP.net is that there is now an options array for the secure and other flags starting with php 7.3.0 the options associated array was added.
If the samesite element is omitted, no SameSite cookie attribute is set. Here is how the new associated array works. `$arrCookieOptions = [
|
Add support for SameSite cookies #3442
Describe the bug
Not possible to configure SameSite setting for cookies (session and CSRF).
The differences between PHP 7.2 and 7.3 makes this more difficult.
I now find myself in the situation that I need to be able to configure this setting and after migration to PHP 7.3 the hack with
cookiePath = '/;samesite=none';
no longer works.I could possible do some work on this, but I'd like to know if there are anything planned before I start working on a PR.
CodeIgniter 4 version
4.0.4
Affected module(s)
Sessions + ?
Expected behavior, and steps to reproduce if appropriate
It should be possible to configure SameSite settings for cookies.
The text was updated successfully, but these errors were encountered: