Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Same-Site Cookie configuration option #3688

Merged
merged 2 commits into from
Aug 16, 2018
Merged

Add Same-Site Cookie configuration option #3688

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e837a77
Add Same-Site Cookie configuration option
nathan-van-der-werf Aug 14, 2018
8775b8b
Add more information about lax / strict mode to phpdoc
nathan-van-der-werf Aug 16, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions config/session.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -150,4 +150,23 @@

'secure' => false,

/*
|--------------------------------------------------------------------------
| Same-Site Cookies
|--------------------------------------------------------------------------
|
| This option determines how your cookies behave when cross-site requests
| take place, and can be used to mitigate CSRF attacks. By default, we
| do not enable this as other CSRF protection services are in place.
|
| In the strict mode, the cookie is not sent with any cross-site usage
| even if the user follows a link to another website. Lax cookies are
| only sent with a top-level get request.
|
| Supported: "lax", "strict"
|
*/

'same_site' => null,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you provide more information on what exactly each of those three options do?

Copy link
Contributor Author

@nathan-van-der-werf nathan-van-der-werf Aug 15, 2018 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The same-site attribute can take one of two values: ‘strict’ or ‘lax’ whereas null is none.

In strict mode, same-site cookies will be withheld for any kind of cross-site usage. This includes all inbound links from external sites to the application. Visitors clicking on such a link will initially be treated as ‘not being logged in’ whether or not they have an active session with the site.

The lax mode caters to applications which are incompatible with these restrictions. In this mode, same-site cookies will be withheld on cross-domain subrequests (e.g. images or frames), but will be sent whenever a user navigates safely from an external site, for example by following a link.

Also see
https://tools.ietf.org/html/draft-west-first-party-cookies-07#section-4.1.1

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you provide a summarized version of that information directly in the doc block for the config option itself?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done, see 8775b8b

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One last question, I know this is in the session.php config in Laravel, but in October we have the separate cookie.php config file, would this make more sense there instead or would that be too confusing?

Copy link
Contributor Author

@nathan-van-der-werf nathan-van-der-werf Aug 16, 2018 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we are moving this to the cookies.php we should move the other cookie configurations also to the cookie.php, like:

  • secure (HTTPS Only Cookies)
  • domain (Session Cookie Domain)
  • path (Session Cookie Path)
  • cookie (Session Cookie Name)

I think for this PR it's better to keep it in the session.php, we can always move it to the cookie.php (with the other cookie configuration options).

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Makes sense to me


];