Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:100323
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain strojny.net from 46.4.40.248 cause and error)
User-Agent: Microsoft-MacOutlook/f.26.0.170822
Date: Mon, 28 Aug 2017 23:16:01 +0200
To: Sara Golemon <pollita@php.net>,
  Frederik Bosch | Genkgo <f.bosch@genkgo.nl>
CC: Andrey Andreev <narf@devilix.net>,
  Dan Ackroyd <danack@basereality.com>,
  "internals@lists.php.net" <internals@lists.php.net>
Message-ID: <0B1B9957-6282-4AD9-82EA-3590DEF89114@strojny.net>
Thread-Topic: [PHP-DEV] [VOTE] Same Site Cookie RFC
References: <a4189866-23ea-4dc5-12a4-a7fbad8e5601@genkgo.nl>
 <CA+kxMuToz+RZ4_t_ta7CRzBu98Ts3U5=cTV--SppGKK85STUEA@mail.gmail.com>
 <CAESVnVpJ0oy+afKhfhKv1trJtnOLmcWFg=DA1G-TpMxfW3jDqw@mail.gmail.com>
 <ffbba599-83ee-07c1-3b68-42bcd9a90009@genkgo.nl>
 <E7AAE43A-CF2D-45E8-A176-9EAFFFEB93C1@strojny.net>
 <CAESVnVrN-M7uDzB6LqXvL8kDxaOarWKmNKdz8nGYG7v1dOQ_BQ@mail.gmail.com>
 <CAPhkiZxKj6qmHreyO+uHFFomKA9Ta5r9ypnFfEUZaQ0A+tGCJw@mail.gmail.com>
 <cc7d025d-8d9c-1cb3-6c8c-75487992edc5@genkgo.nl>
 <CAPhkiZzm2-G5EoewGQy9yd=2A2DLfgp3-XQ9fbPPwBLBzUB=AQ@mail.gmail.com>
 <9422cefb-4dda-9a1d-8856-46ad587f6f60@genkgo.nl>
 <CAESVnVqNbofc=vegqWaKK0cAU25VQ6DR7OCM99vT3JCK8bAQyQ@mail.gmail.com>
In-Reply-To: <CAESVnVqNbofc=vegqWaKK0cAU25VQ6DR7OCM99vT3JCK8bAQyQ@mail.gmail.com>
Mime-version: 1.0
Content-type: multipart/alternative;
	boundary="B_3586806963_219288041"
Subject: Re: [PHP-DEV] [VOTE] Same Site Cookie RFC
From: lars@strojny.net (Lars Strojny)

--B_3586806963_219288041
Content-type: text/plain;
	charset="UTF-8"
Content-transfer-encoding: quoted-printable

Hi Sara, hi Frederik,

=20

Thinking more about this I came to change my vote (and for that reason I=E2=80=99=
ll take back the suggestion to include it into 7.2):

=20
The array API is the better API and allows for healthier future growth so w=
e should pursue that option=20
There is a (very ugly) workaround to set a same site policy by misusing the=
 =E2=80=9Csession.cookie_path=E2=80=9D or =E2=80=9Csession.cookie_domain=E2=80=9D setting (e.g. set =
it to =E2=80=9C/; SameSite=3DStrict=E2=80=9D, you are welcome, Internet).
=20

cu,

Lars

=20

=20

On 28.08.17, 18:20, "Sara Golemon" <php@golemon.com on behalf of pollita@ph=
p.net> wrote:

=20

On Mon, Aug 28, 2017 at 12:10 PM, Frederik Bosch | Genkgo <f.bosch@genkgo.n=
l> wrote:

Little misunderstanding then. I agree we can better have this PHP 7.3 and t=
ake some time for it. Current votes also suggest that we should go for the a=
rray argument implementation. Since there is only a PR for the extra argumen=
t implementation, it will also take time to have the PR for the array argume=
nt implementation ready. Taken that into account, we should not want this in=
 7.2.

Indeed, yes. Assuming the votes continue on this sharp lean towards the arr=
ay option, we should just forget all notions of trying to sneak this into 7.=
2.

=20

Direct calls in 7.2 and earlier can easily fall back on calling header('Set=
-Cookie: ...'); manually, while sessions support is slightly more complex, b=
ut still doable from userspace.  I expect if need is deemed high for this, a=
 drop-in composer package can do 90% of the work automatically.

-Sara=20


--B_3586806963_219288041--