From f820acc14da7feea9ea3fa9e594922f3ea02a003 Mon Sep 17 00:00:00 2001 From: Fabrice Locher Date: Mon, 16 Oct 2023 14:51:42 +0200 Subject: [PATCH 1/3] [10.x] Cookies Having Independent Partitioned State (CHIPS) --- composer.json | 2 +- src/Illuminate/Cookie/Middleware/EncryptCookies.php | 13 ++++++++++--- .../Foundation/Http/Middleware/VerifyCsrfToken.php | 3 ++- src/Illuminate/Session/Middleware/StartSession.php | 13 ++++++++++--- src/Illuminate/Testing/TestResponse.php | 3 ++- 5 files changed, 25 insertions(+), 9 deletions(-) diff --git a/composer.json b/composer.json index a79770c3f587..fc876a9042b0 100644 --- a/composer.json +++ b/composer.json @@ -44,7 +44,7 @@ "symfony/console": "^6.2", "symfony/error-handler": "^6.2", "symfony/finder": "^6.2", - "symfony/http-foundation": "^6.3", + "symfony/http-foundation": "^6.4", "symfony/http-kernel": "^6.2", "symfony/mailer": "^6.2", "symfony/mime": "^6.2", diff --git a/src/Illuminate/Cookie/Middleware/EncryptCookies.php b/src/Illuminate/Cookie/Middleware/EncryptCookies.php index 53a914e70a0a..2b22622d0438 100644 --- a/src/Illuminate/Cookie/Middleware/EncryptCookies.php +++ b/src/Illuminate/Cookie/Middleware/EncryptCookies.php @@ -196,9 +196,16 @@ protected function encrypt(Response $response) protected function duplicate(Cookie $cookie, $value) { return new Cookie( - $cookie->getName(), $value, $cookie->getExpiresTime(), - $cookie->getPath(), $cookie->getDomain(), $cookie->isSecure(), - $cookie->isHttpOnly(), $cookie->isRaw(), $cookie->getSameSite() + $cookie->getName(), + $value, + $cookie->getExpiresTime(), + $cookie->getPath(), + $cookie->getDomain(), + $cookie->isSecure(), + $cookie->isHttpOnly(), + $cookie->isRaw(), + $cookie->getSameSite(), + $cookie->isPartitioned() ); } diff --git a/src/Illuminate/Foundation/Http/Middleware/VerifyCsrfToken.php b/src/Illuminate/Foundation/Http/Middleware/VerifyCsrfToken.php index 69faa52726d2..254139403546 100644 --- a/src/Illuminate/Foundation/Http/Middleware/VerifyCsrfToken.php +++ b/src/Illuminate/Foundation/Http/Middleware/VerifyCsrfToken.php @@ -211,7 +211,8 @@ protected function newCookie($request, $config) $config['secure'], false, false, - $config['same_site'] ?? null + $config['same_site'] ?? null, + $config['partitioned'] ?? false ); } diff --git a/src/Illuminate/Session/Middleware/StartSession.php b/src/Illuminate/Session/Middleware/StartSession.php index 8079ab9c145a..ffc97a5a7213 100644 --- a/src/Illuminate/Session/Middleware/StartSession.php +++ b/src/Illuminate/Session/Middleware/StartSession.php @@ -219,9 +219,16 @@ protected function addCookieToResponse(Response $response, Session $session) { if ($this->sessionIsPersistent($config = $this->manager->getSessionConfig())) { $response->headers->setCookie(new Cookie( - $session->getName(), $session->getId(), $this->getCookieExpirationDate(), - $config['path'], $config['domain'], $config['secure'] ?? false, - $config['http_only'] ?? true, false, $config['same_site'] ?? null + $session->getName(), + $session->getId(), + $this->getCookieExpirationDate(), + $config['path'], + $config['domain'], + $config['secure'] ?? false, + $config['http_only'] ?? true, + false, + $config['same_site'] ?? null, + $config['partitioned'] ?? false )); } } diff --git a/src/Illuminate/Testing/TestResponse.php b/src/Illuminate/Testing/TestResponse.php index 879db5fac8af..79575a984a72 100644 --- a/src/Illuminate/Testing/TestResponse.php +++ b/src/Illuminate/Testing/TestResponse.php @@ -497,7 +497,8 @@ public function getCookie($cookieName, $decrypt = true, $unserialize = false) $cookie->isSecure(), $cookie->isHttpOnly(), $cookie->isRaw(), - $cookie->getSameSite() + $cookie->getSameSite(), + $cookie->isPartitioned() ); } } From 141d2e323adbf2717e2de5641a6700dd92eb2957 Mon Sep 17 00:00:00 2001 From: Fabrice Locher Date: Mon, 16 Oct 2023 14:57:23 +0200 Subject: [PATCH 2/3] Clean up cookie duplication --- src/Illuminate/Cookie/Middleware/EncryptCookies.php | 13 +------------ 1 file changed, 1 insertion(+), 12 deletions(-) diff --git a/src/Illuminate/Cookie/Middleware/EncryptCookies.php b/src/Illuminate/Cookie/Middleware/EncryptCookies.php index 2b22622d0438..c80e4c340e08 100644 --- a/src/Illuminate/Cookie/Middleware/EncryptCookies.php +++ b/src/Illuminate/Cookie/Middleware/EncryptCookies.php @@ -195,18 +195,7 @@ protected function encrypt(Response $response) */ protected function duplicate(Cookie $cookie, $value) { - return new Cookie( - $cookie->getName(), - $value, - $cookie->getExpiresTime(), - $cookie->getPath(), - $cookie->getDomain(), - $cookie->isSecure(), - $cookie->isHttpOnly(), - $cookie->isRaw(), - $cookie->getSameSite(), - $cookie->isPartitioned() - ); + return $cookie->withValue($value); } /** From ba2a61b588a2e511d6416880b495e6422de9ea87 Mon Sep 17 00:00:00 2001 From: Fabrice Locher Date: Thu, 30 Nov 2023 09:49:02 +0100 Subject: [PATCH 3/3] Bump components symfony/http-foundation version --- src/Illuminate/Cookie/composer.json | 2 +- src/Illuminate/Http/composer.json | 2 +- src/Illuminate/Routing/composer.json | 2 +- src/Illuminate/Session/composer.json | 2 +- src/Illuminate/Validation/composer.json | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/src/Illuminate/Cookie/composer.json b/src/Illuminate/Cookie/composer.json index 0e278831b6e0..10277e08b715 100755 --- a/src/Illuminate/Cookie/composer.json +++ b/src/Illuminate/Cookie/composer.json @@ -20,7 +20,7 @@ "illuminate/contracts": "^10.0", "illuminate/macroable": "^10.0", "illuminate/support": "^10.0", - "symfony/http-foundation": "^6.2", + "symfony/http-foundation": "^6.4", "symfony/http-kernel": "^6.2" }, "autoload": { diff --git a/src/Illuminate/Http/composer.json b/src/Illuminate/Http/composer.json index bb21d1853450..94d03fc4e851 100755 --- a/src/Illuminate/Http/composer.json +++ b/src/Illuminate/Http/composer.json @@ -22,7 +22,7 @@ "illuminate/macroable": "^10.0", "illuminate/session": "^10.0", "illuminate/support": "^10.0", - "symfony/http-foundation": "^6.2", + "symfony/http-foundation": "^6.4", "symfony/http-kernel": "^6.2", "symfony/mime": "^6.2" }, diff --git a/src/Illuminate/Routing/composer.json b/src/Illuminate/Routing/composer.json index 11ecf786d243..1375ef059f9a 100644 --- a/src/Illuminate/Routing/composer.json +++ b/src/Illuminate/Routing/composer.json @@ -25,7 +25,7 @@ "illuminate/pipeline": "^10.0", "illuminate/session": "^10.0", "illuminate/support": "^10.0", - "symfony/http-foundation": "^6.2", + "symfony/http-foundation": "^6.4", "symfony/http-kernel": "^6.2", "symfony/routing": "^6.2" }, diff --git a/src/Illuminate/Session/composer.json b/src/Illuminate/Session/composer.json index 392bc21328b5..083ff581a229 100755 --- a/src/Illuminate/Session/composer.json +++ b/src/Illuminate/Session/composer.json @@ -22,7 +22,7 @@ "illuminate/filesystem": "^10.0", "illuminate/support": "^10.0", "symfony/finder": "^6.2", - "symfony/http-foundation": "^6.2" + "symfony/http-foundation": "^6.4" }, "autoload": { "psr-4": { diff --git a/src/Illuminate/Validation/composer.json b/src/Illuminate/Validation/composer.json index 43a2965ecea3..611f05092f38 100755 --- a/src/Illuminate/Validation/composer.json +++ b/src/Illuminate/Validation/composer.json @@ -25,7 +25,7 @@ "illuminate/macroable": "^10.0", "illuminate/support": "^10.0", "illuminate/translation": "^10.0", - "symfony/http-foundation": "^6.2", + "symfony/http-foundation": "^6.4", "symfony/mime": "^6.2" }, "autoload": {