8000 Add SameSite cookies to FrameWorkBundle · symfony/symfony@b0cce6c · GitHub
[go: up one dir, main page]
Skip to content

Commit b0cce6c

Browse files
rpkamprpkamp
committed
Add SameSite cookies to FrameWorkBundle
Uses `session.cookie_samesite` for PHP >= 7.3. For PHP < 7.3 it first does a session_start(), find the emitted header, changes it, and emits it again with the value for SameSite added.
1 parent 441322f commit b0cce6c

File tree

9 files changed

+124
-25
lines changed

9 files changed

+124
-25
lines changed

‎src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
use Symfony\Component\Config\Definition\Builder\TreeBuilder;
2020
use Symfony\Component\Config\Definition\ConfigurationInterface;
2121
use Symfony\Component\Form\Form;
22+
use Symfony\Component\HttpFoundation\Cookie;
2223
use Symfony\Component\Lock\Lock;
2324
use Symfony\Component\Lock\Store\SemaphoreStore;
2425
use Symfony\Component\Messenger\MessageBusInterface;
@@ -482,6 +483,7 @@ private function addSessionSection(ArrayNodeDefinition $rootNode)
482483
->scalarNode('cookie_domain')->end()
483484
->booleanNode('cookie_secure')->end()
484485
->booleanNode('cookie_httponly')->defaultTrue()->end()
486+
->enumNode('cookie_samesite')->values(array(null, Cookie::SAMESITE_LAX, Cookie::SAMESITE_STRICT))->defaultNull()->end()
485487
->booleanNode('use_cookies')->end()
486488
->scalarNode('gc_divisor')->end()
487489
->scalarNode('gc_probability')->defaultValue(1)->end()

‎src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -736,7 +736,7 @@ private function registerSessionConfiguration(array $config, ContainerBuilder $c
736736
// session storage
737737
$container->setAlias('session.storage', $config['storage_id'])->setPrivate(true);
738738
$options = array('cache_limiter' => '0');
739-
foreach (array('name', 'cookie_lifetime', 'cookie_path', 'cookie_domain', 'cookie_secure', 'cookie_httponly', 'use_cookies', 'gc_maxlifetime', 'gc_probability', 'gc_divisor') as $key) {
739+
foreach (array('name', 'cookie_lifetime', 'cookie_path', 'cookie_domain', 'cookie_secure', 'cookie_httponly', 'cookie_samesite', 'use_cookies', 'gc_maxlifetime', 'gc_probability', 'gc_divisor') as $key) {
740740
if (isset($config[$key])) {
741741
$options[$key] = $config[$key];
742742
}

‎src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/ConfigurationTest.php‎

Lines changed: 1 addition & 0 deletions
< 6D40 td data-grid-cell-id="diff-07ea8117c8dbb0ee924c02ce74710a6b1af84e970c60cc82c78f224470241a80-233-234-1" data-selected="false" role="gridcell" style="background-color:var(--diffBlob-additionNum-bgColor, var(--diffBlob-addition-bgColor-num));text-align:center" tabindex="-1" valign="top" class="focusable-grid-cell diff-line-number position-relative left-side">234
Original file line numberDiff line numberDiff line change
@@ -231,6 +231,7 @@ protected static function getBundleDefaultConfig()
231231
'storage_id' => 'session.storage.native',
232232
'handler_id' => 'session.handler.native_file',
233233
'cookie_httponly' => true,
+
'cookie_samesite' => null,
234235
'gc_probability' => 1,
235236
'save_path' => '%kernel.cache_dir%/sessions',
236237
'metadata_update_threshold' => '0',

‎src/Symfony/Component/HttpFoundation/Session/SessionUtils.php‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
<?php
2+
3+
/*
4+
* This file is part of the Symfony package.
5+
*
6+
* (c) Fabien Potencier <fabien@symfony.com>
7+
*
8+
* For the full copyright and license information, please view the LICENSE
9+
* file that was distributed with this source code.
10+
*/
11+
12+
namespace Symfony\Component\HttpFoundation\Session;
13+
14+
/**
15+
* Session utility functions.
16+
*
17+
* @author Nicolas Grekas <p@tchwork.com>
18+
* @author Rémon van de Kamp <rpkamp@gmail.com>
19+
*
20+
* @internal
21+
*/
22+
final class SessionUtils
23+
{
24+
/**
25+
* Find the session header amongst the headers that are to be sent, remove it, and return
26+
* it so the caller can process it further.
27+
*/
28+
public static function popSessionCookie(string $sessionName, string $sessionId): ?string
29+
{
30+
$sessionCookie = null;
31+
$sessionCookiePrefix = sprintf(' %s=', urlencode($sessionName));
32+
$sessionCookieWithId = sprintf('%s%s;', $sessionCookiePrefix, urlencode($sessionId));
33+
$otherCookies = array();
34+
foreach (headers_list() as $h) {
35+
if (0 !== stripos($h, 'Set-Cookie:')) {
36+
continue;
37+
}
38+
if (11 === strpos($h, $sessionCookiePrefix, 11)) {
39+
$sessionCookie = $h;
40+
41+
if (11 !== strpos($h, $sessionCookieWithId, 11)) {
42+
$otherCookies[] = $h;
43+
}
44+
} else {
45+
$otherCookies[] = $h;
46+
}
47+
}
48+
if (null === $sessionCookie) {
49+
return null;
50+
}
51+
52+
header_remove('Set-Cookie');
53+
foreach ($otherCookies as $h) {
54+
header($h, false);
55+
}
56+
57+
return $sessionCookie;
58+
}
59+
}

‎src/Symfony/Component/HttpFoundation/Session/Storage/Handler/AbstractSessionHandler.php‎

Lines changed: 7 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@
1111

1212
namespace Symfony\Component\HttpFoundation\Session\Storage\Handler;
1313

14+
use Symfony\Component\HttpFoundation\Session\SessionUtils;
15+
1416
/**
1517
* This abstract session handler provides a generic implementation
1618
* of the PHP 7.0 SessionUpdateTimestampHandlerInterface,
@@ -121,31 +123,13 @@ public function destroy($sessionId)
121123
if (!$this->sessionName) {
122124
throw new \LogicException(sprintf('Session name cannot be empty, did you forget to call "parent::open()" in "%s"?.', \get_class($this)));
123125
}
124-
$sessionCookie = sprintf(' %s=', urlencode($this->sessionName));
125-
$sessionCookieWithId = sprintf('%s%s;', $sessionCookie, urlencode($sessionId));
126-
$sessionCookieFound = false;
127-
$otherCookies = array();
128-
foreach (headers_list() as $h) {
129-
if (0 !== stripos($h, 'Set-Cookie:')) {
130-
continue;
131-
}
132-
if (11 === strpos($h, $sessionCookie, 11)) {
133-
$sessionCookieFound = true;
134-
135-
if (11 !== strpos($h, $sessionCookieWithId, 11)) {
136-
$otherCookies[] = $h;
137-
}
126+
$cookie = SessionUtils::popSessionCookie($this->sessionName, $sessionId);
127+
if (null === $cookie) {
128+
if (\PHP_VERSION_ID < 70300) {
129+
setcookie($this->sessionName, '', 0, ini_get('session.cookie_path'), ini_get('session.cookie_domain'), ini_get('session.cookie_secure'), ini_get('session.cookie_httponly'));
138130
} else {
139-
$otherCookies[] = $h;
140-
}
141-
}
142-
if ($sessionCookieFound) {
143-
header_remove('Set-Cookie');
144-
foreach ($otherCookies as $h) {
145-
header($h, false);
131+
setcookie($this->sessionName, '', 0, ini_get('session.cookie_path'), ini_get('session.cookie_domain'), ini_get('session.cookie_secure'), ini_get('session.cookie_httponly'), ini_get('session.cookie_samesite'));
146132
}
147-
} else {
148-
setcookie($this->sessionName, '', 0, ini_get('session.cookie_path'), ini_get('session.cookie_domain'), ini_get('session.cookie_secure'), ini_get('session.cookie_httponly'));
149133
}
150134
}
151135

‎src/Symfony/Component/HttpFoundation/Session/Storage/NativeSessionStorage.php‎

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
namespace Symfony\Component\HttpFoundation\Session\Storage;
1313

1414
use Symfony\Component\HttpFoundation\Session\SessionBagInterface;
15+
use Symfony\Component\HttpFoundation\Session\SessionUtils;
1516
use Symfony\Component\HttpFoundation\Session\Storage\Handler\StrictSessionHandler;
1617
use Symfony\Component\HttpFoundation\Session\Storage\Proxy\AbstractProxy;
1718
use Symfony\Component\HttpFoundation\Session\Storage\Proxy\SessionHandlerProxy;
@@ -48,6 +49,11 @@ class NativeSessionStorage implements SessionStorageInterface
4849
*/
4950
protected $metadataBag;
5051

52+
/**
53+
* @var string|null
54+
*/
55+
private $emulateSameSite;
56+
5157
/**
5258
* Depending on how you want the storage driver to behave you probably
5359
* want to override this constructor entirely.
@@ -67,6 +73,7 @@ class NativeSessionStorage implements SessionStorageInterface
6773
* cookie_lifetime, "0"
6874
* cookie_path, "/"
6975
* cookie_secure, ""
76+
* cookie_samesite, null
7077
* gc_divisor, "100"
7178
* gc_maxlifetime, "1440"
7279
* gc_probability, "1"
@@ -143,6 +150,13 @@ public function start()
143150
throw new \RuntimeException('Failed to start the session');
144151
}
145152

153+
if (null !== $this->emulateSameSite) {
154+
$originalCookie = SessionUtils::popSessionCookie(session_name(), session_id());
155+
if (null !== $originalCookie) {
156+
header(sprintf('%s; SameSite=%s', $originalCookie, $this->emulateSameSite));
157+
}
158+
}
159+
146160
$this->loadSession();
147161

148162
return true;
@@ -347,7 +361,7 @@ public function setOptions(array $options)
347361

348362
$validOptions = array_flip(array(
349363
'cache_expire', 'cache_limiter', 'cookie_domain', 'cookie_httponly',
350-
'cookie_lifetime', 'cookie_path', 'cookie_secure',
364+
'cookie_lifetime', 'cookie_path', 'cookie_secure', 'cookie_samesite',
351365
'gc_divisor', 'gc_maxlifetime', 'gc_probability',
352366
'lazy_write', 'name', 'referer_check',
353367
'serialize_handler', 'use_strict_mode', 'use_cookies',
@@ -359,6 +373,12 @@ public function setOptions(array $options)
359373

360374
foreach ($options as $key => $value) {
361375
if (isset($validOptions[$key])) {
376+
if ('cookie_samesite' === $key && \PHP_VERSION_ID < 70300) {
377+
// PHP < 7.3 does not support same_site cookies. We will emulate it in
378+
// the start() method instead.
379+
$this->emulateSameSite = $value;
380+
continue;
381+
}
362382
ini_set('url_rewriter.tags' !== $key ? 'session.'.$key : $key, $value);
363383
}
364384
}

‎src/Symfony/Component/HttpFoundation/Tests/Session/Storage/Handler/Fixtures/with_samesite.expected‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
open
2+
validateId
3+
read
4+
doRead:
5+
read
6+
7+
write
8+
doWrite: foo|s:3:"bar";
9+
close
10+
Array
11+
(
12+
[0] => Content-Type: text/plain; charset=utf-8
13+
[1] => Cache-Control: max-age=0, private, must-revalidate
14+
[2] => Set-Cookie: sid=random_session_id; path=/; secure; HttpOnly; SameSite=lax
15+
)
16+
shutdown

‎src/Symfony/Component/HttpFoundation/Tests/Session/Storage/Handler/Fixtures/with_samesite.php‎

Lines changed: 13 additions & 0 deletions
38BA
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
<?php
2+
3+
require __DIR__.'/common.inc';
4+
5+
use Symfony\Component\HttpFoundation\Session\Storage\NativeSessionStorage;
6+
7+
$storage = new NativeSessionStorage(array('cookie_samesite' => 'lax'));
8+
$storage->setSaveHandler(new TestSessionHandler());
9+
$storage->start();
10+
11+
$_SESSION = array('foo' => 'bar');
12+
13+
ob_start(function ($buffer) { return str_replace(session_id(), 'random_session_id', $buffer); });

‎src/Symfony/Component/HttpFoundation/Tests/Session/Storage/NativeSessionStorageTest.php‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -171,6 +171,10 @@ public function testCookieOptions()
171171
'cookie_httponly' => false,
172172
);
173173

174+
if (\PHP_VERSION_ID >= 70300) {
175+
$options['cookie_samesite'] = 'lax';
176+
}
177+
174178
$this->getStorage($options);
175179
$temp = session_get_cookie_params();
176180
$gco = array();

0 commit comments

Comments
 (0)
0