Feature: About the SameSite COOKIE RFC changes for PHP > 7.3

[crustamet]

Hello in the old Codeigniter 3
i had an option to use this directly on the config of cookiePath...
$cookiePath = '/; SameSite=strict'

setcookie('samesite-test', '1', 0, '/; samesite=strict');

Now with the new C4 this doesnt work anymore
Please introduce this SameSite Cookie config setting into the
Config/App.php File
$cookieSameSite = 'strict'; // or lax; i think they are 3 options, none, strict and lax... that have to be implemented..

Please guys send a message if you are thinking of implementing this.
Because for me this is very important !

// by default or something....

[jim-parry]

@lonnieezell Is this something overlooked? It feels like a feature request more than a bug.

[lonnieezell]

Looks like OP was using a bit of a hack to get it to work. I think it's a worthy addition - but definitely a new feature. Tag it for the first release after 4.0 I think.

[crustamet]

The problem for this to fix it well it is a bit of a change if you want to add the feature

i just documented myself, and with the setcookie function the settings of the session should be passed as array not as simple variables....

So i understand for this you will have to change a lot of stuff.

What i think is to make it work now at the present and not focuse on this task in the future...

This is a major concern this will help other problems to be solved...

[natanfelles]

Requires PHP >= 7.3
https://www.php.net/manual/en/function.setcookie.php#refsect1-function.setcookie-changelog

[nControl88]

There exists a workaround for PHP < 7.3.

Following code is from vendor\codeigniter4\framework\system\Security\Security.php: CSRFSetCookie(RequestInterface $request) with $this->CSRFCookieSameSite as an added attribute:

if (PHP_VERSION_ID < 70300) {
	setcookie(
		$this->CSRFCookieName, $this->CSRFHash, $expire, $this->cookiePath . "; samesite=" . $this->CSRFCookieSameSite, $this->cookieDomain, $secure_cookie, true                // Enforce HTTP only cookie for security
	);
}
else {
	setcookie($this->CSRFCookieName, $this->CSRFHash, [
		'expires' => $expire,
		'path' => $this->cookiePath,
		'domain' => $this->cookieDomain,
		'secure' => $secure_cookie,
		'httponly' => true,         // Enforce HTTP only cookie for security
		'samesite' => $this->CSRFCookieSameSite,
	]);
}

[crustamet]

after 4 months i am happy this was added in, seriously :)