We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Firefox warns about the laminas-hidden cookie. In specific, it references the following documentation: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite#samesitenone_requires_secure
laminas-hidden
The problem is that the cookie will be rejected by future browser versions.
laminas-hidden cookie is set with SameSite=None and without secure.
SameSite=None
secure
I believe the code responsible for this behaviour is located here: https://github.com/laminas/laminas-developer-tools/blob/2.4.x/view/laminas-developer-tools/toolbar/toolbar.js
Enable the laminas-developer-tools toolbar. Visit your website. Observe the console output of your browser.
No warnings should be thrown.
Since not all websites under development are served over a secure connection, I propose setting SameSite=Lax.
SameSite=Lax
The text was updated successfully, but these errors were encountered:
No branches or pull requests
Bug Report
Summary
Firefox warns about the
laminas-hidden
cookie. In specific, it references the following documentation: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite#samesitenone_requires_secureThe problem is that the cookie will be rejected by future browser versions.
Current behavior
laminas-hidden
cookie is set withSameSite=None
and withoutsecure
.I believe the code responsible for this behaviour is located here: https://github.com/laminas/laminas-developer-tools/blob/2.4.x/view/laminas-developer-tools/toolbar/toolbar.js
How to reproduce
Enable the laminas-developer-tools toolbar. Visit your website. Observe the console output of your browser.
Expected behavior
No warnings should be thrown.
Since not all websites under development are served over a secure connection, I propose setting
SameSite=Lax
.The text was updated successfully, but these errors were encountered: