How to tell PHP to use SameSite=None for cross-site cookies?

Deadly 提交于 2020-05-26 12:20:31

问题


According to the article here https://php.watch/articles/PHP-Samesite-cookies and PHP documenation at https://www.php.net/manual/en/session.security.ini.php, There are only 2 possible config options for this new feature, added in PHP 7.3:

  1. session.cookie_samesite=Lax
  2. session.cookie_samesite=Strict

Yet, according to the Chrome console, this needs to be set to "None":

A cookie associated with a cross-site resource at URL was set without the SameSite attribute. It has been blocked, as Chrome now only delivers cookies with cross-site requests if they are set with SameSite=None and Secure. You can review cookies in developer tools under Application>Storage>Cookies and see more details at URL and URL.

Because of this, I can no longer set cross-site cookies. What is the workaround?


回答1:


You can set the value to "None" using ini_set. There's no check that the value is supported when that function is used:

ini_set('session.cookie_samesite', 'None');
session_start();

session_set_cookie_params can also set it:

session_set_cookie_params(['samesite' => 'None']);
session_start();

The bug report for this to be supported in php.ini is here.




回答2:


Bad:

session.cookie_samesite=None

Correct:

session.cookie_samesite="None"

Explanation here




回答3:


This method can be helpful for u

Add header's attributes on nginx below Secure + SameSite=None

location / {

proxy_cookie_path / "/; secure; SameSite=none";

}

It's working on me!



来源:https://stackoverflow.com/questions/59534999/how-to-tell-php-to-use-samesite-none-for-cross-site-cookies

易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!