Adds support for the SameSite attribute in cookies. #19104
$sameSite can be set to false, "lax", or "strict". You can read about what the different modes do here: http://www.sjoerdlangkemper.nl/2016/04/14/preventing-csrf-with-samesite-cookie-attribute/
- Loading branch information
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -26,6 +26,7 @@ class Cookie | |
| protected $secure; | ||
| protected $httpOnly; | ||
| private $raw; | ||
| protected $sameSite; | ||
|
|
||
| /** | ||
| * Constructor. | ||
|
|
@@ -38,10 +39,11 @@ class Cookie | |
| * @param bool $secure Whether the cookie should only be transmitted over a secure HTTPS connection from the client | ||
| * @param bool $httpOnly Whether the cookie will be made accessible only through the HTTP protocol | ||
| * @param bool $raw Whether the cookie value should be sent with no url encoding | ||
| * @param bool|string $sameSite Whether the cookie will be available for cross-site requests | ||
|
There was a problem hiding this comment. wouldn't There was a problem hiding this comment. It's good practice to adhere to the spec name, i.e. There was a problem hiding this comment.
|
||
| * | ||
| * @throws \InvalidArgumentException | ||
| */ | ||
| public function __construct($name, $value = null, $expire = 0, $path = '/', $domain = null, $secure = false, $httpOnly = true, $raw = false, $sameSite = false) | ||
| { | ||
| // from PHP source code | ||
| if (preg_match("/[=,; \t\r\n\013\014]/", $name)) { | ||
|
|
@@ -71,6 +73,7 @@ public function __construct($name, $value = null, $expire = 0, $path = '/', $dom | |
| $this->secure = (bool) $secure; | ||
| $this->httpOnly = (bool) $httpOnly; | ||
| $this->raw = (bool) $raw; | ||
| $this->sameSite = $sameSite; | ||
|
There was a problem hiding this comment. What about validating the domain? I.e. allowed values ( |
||
| } | ||
|
|
||
| /** | ||
|
|
@@ -107,6 +110,10 @@ public function __toString() | |
| if (true === $this->isHttpOnly()) { | ||
| $str .= '; httponly'; | ||
| } | ||
|
|
||
| if (false !== $this->hasSameSite()) { | ||
| $str .= '; samesite='.$this->getSameSite(); | ||
| } | ||
|
|
||
| return $str; | ||
| } | ||
|
|
@@ -200,4 +207,24 @@ public function isRaw() | |
| { | ||
| return $this->raw; | ||
| } | ||
|
|
||
| /** | ||
| * Gets the SameSite attribute. | ||
| * | ||
| * @return string|bool | ||
| */ | ||
| public function getSameSite() | ||
| { | ||
| return $this->sameSite; | ||
| } | ||
|
|
||
| /** | ||
| * Checks if the cookie value should be sent with a SameSite attribute. | ||
| * | ||
| * @return bool | ||
| */ | ||
| public function hasSameSite() | ||
|
There was a problem hiding this comment. What about There was a problem hiding this comment. As it's not a pure boolean property, you could also consider There was a problem hiding this comment. I suggest to remove this method, using There was a problem hiding this comment. Oh, hah, |
||
| { | ||
| return $this->sameSite !== false; | ||
|
There was a problem hiding this comment. Please, use Yoda condition. |
||
| } | ||
| } |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
should be
private