8000 bug #36175 [Security/Http] Remember me: allow to set the samesite coo… · symfony/symfony@438d9e5 · GitHub
[go: up one dir, main page]
Skip to content

Commit 438d9e5

Browse files
nicolas-grekasnicolas-grekas
committed
bug #36175 [Security/Http] Remember me: allow to set the samesite cookie flag (dunglas)
This PR was merged into the 3.4 branch. Discussion ---------- [Security/Http] Remember me: allow to set the samesite cookie flag | Q | A | ------------- | --- | Branch? | 3.4 | Bug fix? | yes | New feature? | no | Deprecations? | no | Tickets | - | License | MIT | Doc PR | - Similar to #35605, since Chrome 80 is going to require the `samesite` attribute. This is a cherry-pick of #27976 Commits ------- f0ceb73 [Security] Remember me: allow to set the samesite cookie flag
2 parents b4ec8b9 + f0ceb73 commit 438d9e5

File tree

6 files changed

+18
-6
lines changed

6 files changed

+18
-6
lines changed

‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/Security/Factory/RememberMeFactory.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ class RememberMeFactory implements SecurityFactoryInterface
2525
'domain' => null,
2626
'secure' => false,
2727
'httponly' => true,
28+
'samesite' => null,
2829
'always_remember_me' => false,
2930
'remember_me_parameter' => '_remember_me',
3031
];

‎src/Symfony/Component/Security/Http/RememberMe/AbstractRememberMeServices.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ abstract class AbstractRememberMeServices implements RememberMeServicesInterface
3838
protected $options = [
3939
'secure' => false,
4040
'httponly' => true,
41+
'samesite' => null,
4142
];
4243
private $providerKey;
4344
private $secret;
@@ -281,7 +282,7 @@ protected function cancelCookie(Request $request)
281282
$this->logger->debug('Clearing remember-me cookie.', ['name' => $this->options['name']]);
282283
}
283284

284-
$request->attributes->set(self::COOKIE_ATTR_NAME, new Cookie($this->options['name'], null, 1, $this->options['path'], $this->options['domain'], $this->options['secure'], $this->options['httponly']));
285+
$request->attributes->set(self::COOKIE_ATTR_NAME, new Cookie($this->options['name'], null, 1, $this->options['path'], $this->options['domain'], $this->options['secure'], $this->options['httponly'], false, $this->options['samesite']));
285286
}
286287

287288
/**

‎src/Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices.php‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,9 @@ protected function processAutoLoginCookie(array $cookieParts, Request $request)
8484
$this->options['path'],
8585
$this->options['domain'],
8686
$this->options['secure'],
87-
$this->options['httponly']
87+
$this->options['httponly'],
88+
false,
89+
$this->options['samesite']
8890
)
8991
);
9092

@@ -117,7 +119,9 @@ protected function onLoginSuccess(Request $request, Response $response, TokenInt
117119
$this->options['path'],
118120
$this->options['domain'],
119121
$this->options['secure'],
120-
$this->options['httponly']
122+
$this->options['httponly'],
123+
false,
124+
$this->options['samesite']
121125
)
122126
);
123127
}

‎src/Symfony/Component/Security/Http/RememberMe/TokenBasedRememberMeServices.php‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,9 @@ protected function onLoginSuccess(Request $request, Response $response, TokenInt
8181
$this->options['path'],
8282
$this->options['domain'],
8383
$this->options['secure'],
84-
$this->options['httponly']
84+
$this->options['httponly'],
85+
false,
86+
$this->options['samesite']
8587
)
8688
);
8789
}

‎src/Symfony/Component/Security/Http/Tests/RememberMe/PersistentTokenBasedRememberMeServicesTest.php‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
namespace Symfony\Component\Security\Http\Tests\RememberMe;
1313

1414
use PHPUnit\Framework\TestCase;
15+
use Symfony\Component\HttpFoundation\Cookie;
1516
use Symfony\Component\HttpFoundation\Request;
1617
use Symfony\Component\HttpFoundation\Response;
1718
use Symfony\Component\HttpFoundation\ResponseHeaderBag;
@@ -268,7 +269,7 @@ public function testLoginFail()
268269

269270
public function testLoginSuccessSetsCookieWhenLoggedInWithNonRememberMeTokenInterfaceImplementation()
270271
{
271-
$service = $this->getService(null, ['name' => 'foo', 'domain' => 'myfoodomain.foo', 'path' => '/foo/path', 'secure' => true, 'httponly' => true, 'lifetime' => 3600, 'always_remember_me' => true]);
272+
$service = $this->getService(null, ['name' => 'foo', 'domain' => 'myfoodomain.foo', 'path' => '/foo/path', 'secure' => true, 'httponly' => true, 'samesite' => Cookie::SAMESITE_STRICT, 'lifetime' => 3600, 'always_remember_me' => true]);
272273
$request = new Request();
273274
$response = new Response();
274275

@@ -305,6 +306,7 @@ public function testLoginSuccessSetsCookieWhenLoggedInWithNonRememberMeTokenInte
305306
$this->assertTrue($cookie->getExpiresTime() > time() + 3590 && $cookie->getExpiresTime() < time() + 3610);
306307
$this->assertEquals('myfoodomain.foo', $cookie->getDomain());
307308
$this->assertEquals('/foo/path', $cookie->getPath());
309+
$this->assertSame(Cookie::SAMESITE_STRICT, $cookie->getSameSite());
308310
}
309311

310312
protected function encodeCookie(array $parts)

‎src/Symfony/Component/Security/Http/Tests/RememberMe/TokenBasedRememberMeServicesTest.php‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
namespace Symfony\Component\Security\Http\Tests\RememberMe;
1313

1414
use PHPUnit\Framework\TestCase;
15+
use Symfony\Component\HttpFoundation\Cookie;
1516
use Symfony\Component\HttpFoundation\Request;
1617
use Symfony\Component\HttpFoundation\Response;
1718
use Symfony\Component\HttpFoundation\ResponseHeaderBag;
@@ -205,7 +206,7 @@ public function testLoginSuccessIgnoresTokensWhichDoNotContainAnUserInterfaceImp
205206

206207
public function testLoginSuccess()
207208
{
208-
$service = $this->getService(null, ['name' => 'foo', 'domain' => 'myfoodomain.foo', 'path' => '/foo/path', 'secure' => true, 'httponly' => true, 'lifetime' => 3600, 'always_remember_me' => true]);
209+
$service = $this->getService(null, ['name' => 'foo', 'domain' => 'myfoodomain.foo', 'path' => '/foo/path', 'secure' => true, 'httponly' => true, 'samesite' => Cookie::SAMESITE_STRICT, 'lifetime' => 3600, 'always_remember_me' => true]);
209210
$request = new Request();
210211
$response = new Response();
211212

@@ -240,6 +241,7 @@ public function testLoginSuccess()
240241
$this->assertTrue($cookie->getExpiresTime() > time() + 3590 && $cookie->getExpiresTime() < time() + 3610);
241242
$this->assertEquals('myfoodomain.foo', $cookie->getDomain());
242243
$this->assertEquals('/foo/path', $cookie->getPath());
244+
$this->assertSame(Cookie::SAMESITE_STRICT, $cookie->getSameSite());
243245
}
244246

245247
protected function getCookie($class, $username, $expires, $password)

0 commit comments

Comments
 (0)
0