Support SameSite cookie

Hi,

I've a web that's run latest CI3 version, it's impossible to us upgrade to 4.X now and we need support for SameSite cookie.

I think than the CI3 Developers must publish a minor version of CI3 with SameSite support asap.

A lot of CI3 users need this features.

Regards!

You can do it yourself for the time being.

Secure better your website with SameSite cookies

What did you Try? What did you Get? What did you Expect?

Joined CodeIgniter Community 2009.  ( Skype: insitfx )

You can do it yourself for the time being.

Secure better your website with SameSite cookies

Yes, i know, but is a basic feature and i think easy to implement y CI3 core.

Yes, i know, but is a basic feature and i think easy to implement y CI3 core.

If it is really easy, why does CI3 not have it yet?

ci-phpunit-test | CodeIgniter Testing Guide | CodeIgniter 3 to 4 Upgrade Helper

You can do it yourself for the time being.

Secure better your website with SameSite cookies

Out of interest, what's the easiest way of doing this?  So far I had to extend the built in session library class, copy the class contructor and add the samesite attribute there.

I toyed around with ini_set('session.samesite', 1); but it didn't seem to work.

Further to my comment above, I've since ditched the idea of extending the session class and have instead added the samesite cookie attribute to my core system file.  I know this is terrible practice but it was less messy than extending the session class, and I'm hoping the samesite attribute is included in a future patch/version, therefore rendering my change temporary.

I did this by modifying line 163 in /system/libraries/Session/Session.php from:

PHP Code:

setcookie(
    $this->_config['cookie_name'],
    session_id(),
    (empty($this->_config['cookie_lifetime']) ? 0 : time() + $this->_config['cookie_lifetime']),
    $this->_config['cookie_path'],
    $this->_config['cookie_domain'],
    $this->_config['cookie_secure'],
    TRUE
); 


to

PHP Code:

setcookie(
    $this->_config['cookie_name'],
    session_id(),
    [
    'expires' => (empty($this->_config['cookie_lifetime']) ? 0 : time() + $this->_config['cookie_lifetime']),
    'path' => $this->_config['cookie_path'],
    'domain' => $this->_config['cookie_domain'],
    'secure' => $this->_config['cookie_secure'],
    'httponly' => TRUE,
    'samesite' => 'Lax',
    ]
); 


Really the samesite attribute should be configurable rather than hardcoded, and again I realise changing core system files is generally not acceptable.  In our case I just want to set this attribute with as little fuss as possible, and hope for a more permanent solution in the future.

Note: The above also assumes you are on PHP 7.3 or higher.