Collectives™ on Stack Overflow

Find centralized, trusted content and collaborate around the technologies you use most.

Teams

Q&A for work

Connect and share knowledge within a single location that is structured and easy to search.

I recently read "RFC 6265" on the attribute "Same Site", I looked at some articles that talked about that in April 2016, "same-site" attribute has been implemented for Chrome 51 and Opera 39 ...

I wonder if current PHP supports creating cookies with this attribute?

Reference:

1. For PHP >= v7.3

You can use the $options array to set the samesite value, for example:

setcookie($name, $value, [
    'expires' => time() + 86400,
    'path' => '/',
    'domain' => 'domain.example',
    'secure' => true,
    'httponly' => true,
    'samesite' => 'None',
The value of the samesite element should be either None, Lax or Strict.
Read more in the manual page.
2. For PHP < v7.3
You can use one of the following solutions/workarounds depending on your codebase/needs
2.1 Setting SameSite cookies using Apache configuration
You can add the following line to your Apache configuration
Header always edit Set-Cookie (.*) "$1; SameSite=Lax"
and this will update all your cookies with SameSite=Lax flag
See more here: https://blog.giantgeek.com/?p=1872
2.2 Setting SameSite cookies using Nginx configuration
location / {
    # your usual config ...
    # hack, set all cookies to secure, httponly and samesite (strict or lax)
    proxy_cookie_path / "/; secure; HttpOnly; SameSite=strict";
Same here, this also will update all your cookies with SameSite=Lax flag
See more here: https://serverfault.com/questions/849888/add-samesite-to-cookies-using-nginx-as-reverse-proxy
2.3 Setting SameSite cookies using header method
As we know cookies are just a header in HTTP request with the following structure
Set-Cookie: key=value; path=/; domain=example.org; HttpOnly; SameSite=Lax
so we can just set the cookies with header method
header("Set-Cookie: key=value; path=/; domain=example.org; HttpOnly; SameSite=Lax");
In fact, Symfony is not waiting for PHP 7.3 and already doing it under the hood, see here
📝You can use same in Laravel too because Laravel under the hood using Symfony's Symfony\Component\HttpFoundation\Cookie class
2.4 Setting SameSite cookies using a bug in setcookie method
setcookie('cookie-name', '1', 0, '/; samesite=strict');
Be careful with this one, it's a known bug in PHP setcookie method and already resolved in PHP7.3 version, see here - https://github.com/php/php-src/commit/5cb825df7251aeb28b297f071c35b227a3949f01
                It doesn't look like that's the correct method signature for setcookie (and setrawcookie) in PHP 7.3+, an array of options is passed as the third parameter, one of which is called samesite. See github.com/php/php-src/blob/PHP-7.3/UPGRADING#L350
– rink.attendant.6
                Oct 9, 2018 at 8:51
                PHP Manual states that samesite is passed as part of an array in the setcookie 3rd parameter as shown here: php.net/manual/en/function.setcookie.php
– Jarom
                Oct 18, 2019 at 20:52
                @Jarom Indeed, the RFC link the answerer posted regarding setcookie says at the bottom under Errata: "The actually implemented alternative signatures of the functions have been slightly changed from the original RFC. See the documentation in the PHP manual for details". Looking at the manual there is no mention of a samesite argument. Instead the manual only mentions it as a value of an $options array. Can someone confirm if the samesite argument actually works?
– Cave Johnson
                Jan 22, 2020 at 21:39
                @marcovtwout Yes, the injection in session_set_cookie_params() did also work for me in PHP 7.2.24 the same way and I didn't find a fix for this in the PHP changelog, which is ok for me :)
– malisokan
                Sep 11, 2020 at 14:29
[Important update: As @caw pointed out below, this hack WILL BREAK in PHP 7.3. Stop using it now to save yourself from unpleasant surprises! Or at least wrap it in a PHP version check like if (PHP_VERSION_ID < 70300) { ... } else { ... }.]
It seems like you can abuse the "path" or "domain" parameter of PHP's "setcookie" function to sneak in the SameSite attribute because PHP does not escape semicolons:
setcookie('samesite-test', '1', 0, '/; samesite=strict');
Then PHP sends the following HTTP header:
  
Set-Cookie: samesite-test=1; path=/; samesite=strict
I've just discovered this a few minutes ago, so please do your own testing! I'm using PHP 7.1.11.
                I found the answer interesting, I confess that I have never tried this because the specification does not speak (as far as I remember) of this possibility ... I will test this to see how it behaves
– Lauro Moraes
                Oct 27, 2017 at 14:14
                I have tested in phptester on PHP 7.0 and this test is successfull... many thanks for you response!
– Lauro Moraes
                Dec 24, 2017 at 17:15
                Excellent hack – as long as it doesn’t break, which it hopefully doesn’t. But you have to watch future PHP releases for changes to this function. In the best case, this works until PHP ships the updated setcookie method that supports the feature directly, which may be PHP 7.3, as can be read in the other answer.
– caw
                Jan 21, 2018 at 20:34
                It looks like this may indeed stop working soon (probably in PHP 7.3): github.com/php/php-src/commit/…
– caw
                Apr 6, 2018 at 18:24
                This hack now fails in later versions. The options array solution from Marty works though.
– misteraidan
                Jun 26, 2020 at 2:08
Based on Steffen's answer above, this is the method I am using to support both php <= 7.2 and php >= 7.3:
 * Support samesite cookie flag in both php 7.2 (current production) and php >= 7.3 (when we get there)
 * From: https://github.com/GoogleChromeLabs/samesite-examples/blob/master/php.md and https://stackoverflow.com/a/46971326/2308553 
 * @see https://www.php.net/manual/en/function.setcookie.php
 * @param string $name
 * @param string $value
 * @param int $expire
 * @param string $path
 * @param string $domain
 * @param bool $secure
 * @param bool $httponly
 * @param string $samesite
 * @return void
function setCookieSameSite(
    string $name, string $value,
    int $expire, string $path, string $domain,
    bool $secure, bool $httponly, string $samesite = 'None'
): void {
    if (PHP_VERSION_ID < 70300) {
        setcookie($name, $value, $expire, $path . '; samesite=' . $samesite, $domain, $secure, $httponly);
        return;
    setcookie($name, $value, [
        'expires' => $expire,
        'path' => $path,
        'domain' => $domain,
        'samesite' => $samesite,
        'secure' => $secure,
        'httponly' => $httponly,
                Thanks for this answer, could you point me where to implement this function in Drupal 7 (PHP 7.2.2).
– Elber CM
                Apr 20, 2020 at 14:24
I wrote a class for setting samesite cookies.
https://github.com/ovunctukenmez/SameSiteCookieSetter
It works on all PHP versions.
It also checks if the browser supports samesite parameter properly.
Here is the usage:
//set samesite strict php cookie
SameSiteCookieSetter::setcookie('samesite_test','testvalue', array('samesite' => 'Strict'));
                I tested your code. for PHP < 7.3, you are checking if the header contains Set-Cookie. but in my case, my header doesn't have Set-Cookie. so I cant set samsite for my session cookie. do you have any idea why?
– Imanez
                Mar 29, 2020 at 12:23
According to this site, it seems it is a matter of PHP 7.3. As of the voting results, a more general extension to cookie-related functions is being implemented + there might be also a new key in php.ini file.
But as Marc B already wrote, you can use header() function call instead, I would do it in some file with used for inclusion of other initial stuff.
This might also help for someone still struggling, and using PHP >= 7.3.x and using CI 3.1.11
In the index.php found in the root, add the line below <?php
if(isset($_COOKIE["PHPSESSID"])){
    header('Set-Cookie: PHPSESSID='.$_COOKIE["PHPSESSID"].'; SameSite=None');
It worked for me, after trying it all (in vain)
Adding to the answer by Marty Aghajanyan (because apparently I can answer, but not yet comment)
Doing it in Apache via mod_headers in conjunction with PHP was not working for me in Apache 2.4.29 (Ubuntu). In reviewing the docs (http://www.balkangreenfoundation.org/manual/en/mod/mod_headers.html) I noticed the "always" condition has certain situations where it does not work from the same pool of response headers. Thus the following worked for me to set the SameSite parameter.  (Tho in my case I am setting None for the recent Chrome 80 update)
Header edit Set-Cookie ^(.*)$ "$1; Secure; SameSite=None"
The docs also suggest that if you want to cover all your bases you could add the directive both with and without "always", but I have not tested that.
Worth mentioning that Safari 12 on both macOS and iOS will not recognise a value of None for the SameSite attribute, and default to a value of Strict.
Version 13 will accept "None", but without explicitly setting a value, it defaults to "Lax".
Here's a good explanation:
https://www.thinktecture.com/en/identity/samesite/samesite-in-a-nutshell/
There are a lot of examples showing how to set this attribute, but not many explanations of why.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#SameSite_attribute
  
If a cookie is needed to be sent cross-origin, opt out of the SameSite restriction by using the None directive. The None directive requires that the Secure attribute also be used.
The examples that are setting SameSite to None or Lax are only appropriate for cross-domain scenarios. If your code isn't cross-domain, use Strict.
As new browsers, it requires to set both secure and httponly with samesite attributes.

So you must use all ini set before the session_start().
Example :
ini_set('session.cookie_samesite', 'None');
ini_set('session.cookie_secure', 'On');
ini_set('session.cookie_httponly', 'On');
session_start();
Don't forget that :
you need to use https when enabling secure cookie
        
Thanks for contributing an answer to Stack Overflow!
Please be sure to answer the question. Provide details and share your research!
But avoid …
Asking for help, clarification, or responding to other answers.
Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.