Set samesite=strict coockies - will work starting php 7.3

owncloud · May 27, 2020 · 7429797 · 7429797
1 parent 5ef3bad
commit 7429797
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 1 deletion.
diff --git a/changelog/unreleased/37442 b/changelog/unreleased/37442
@@ -0,0 +1,3 @@
+Change: Use strict samesite cookie
+
+https://github.com/owncloud/core/pull/37442
diff --git a/lib/private/Session/CryptoWrapper.php b/lib/private/Session/CryptoWrapper.php
@@ -89,7 +89,21 @@ public function __construct(IConfig $config,
 				if ($webRoot === '') {
 					$webRoot = '/';
 				}
-				\setcookie(self::COOKIE_NAME, $this->passphrase, 0, $webRoot, '', $secureCookie, true);
+
+				if (\version_compare(PHP_VERSION, '7.3.0') === -1) {
+					\setcookie(self::COOKIE_NAME, $this->passphrase, 0, $webRoot, '', $secureCookie, true);
+				} else {
+					$options = [
+						"expires" => 0,
+						"path" => $webRoot,
+						"domain" => '',
+						"secure" => $secureCookie,
+						"httponly" => true,
+						"samesite" => 'strict'
+					];
+
+					\setcookie(self::COOKIE_NAME, $this->passphrase, $options);
+				}
 			}
 		}
 	}
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,3 @@
		Change: Use strict samesite cookie

		https://github.com/owncloud/core/pull/37442