Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:102983
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain devilix.net designates 74.125.82.49 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXa=4nv0D3=7MhrzYbDYMvryG38fgbgpL=tR6sBw5hMjUQ@mail.gmail.com>
References: <a4189866-23ea-4dc5-12a4-a7fbad8e5601@genkgo.nl>
 <1abd260d-ebc4-a062-3381-72485946e8bc@gmail.com> <a55b37e3-268c-f8ab-6545-6cf7a4f537f0@genkgo.nl>
 <CAJd4=Ya67XaX3bwwQn20GUQqEvEVe8XEepRz9+of6h4t4fC_fg@mail.gmail.com>
 <CAPhkiZzSfwMd7TthF7jcWwY+JTnFyamyevnWDZZhGGF_qpEpKA@mail.gmail.com>
 <CAJd4=YZfMgJ7pLwUx_0GqdV+KMCGqYZFhQEDV_2KTMOKiRi6dA@mail.gmail.com>
 <CAPhkiZyHTy8m8N9f531GTMcNNhWO7Rj0U9vtMXzg3FhGyJQ0Vg@mail.gmail.com>
 <CANUQDCjam10D2SANrXQBCau8wAKQyD2gXZO7Q2fiKYQHDOhUzQ@mail.gmail.com>
 <CAJd4=YboTqF5_rUy=YhB8xNV_K=1rrkTNLg+dr1MOQrLxNmdBQ@mail.gmail.com>
 <CANUQDCjp1zMtPYX5eQmTBEdU0UmnVNiaYiXO-R9EZSztQnr4UA@mail.gmail.com>
 <CAGa2bXbhKowGjj5i9DSg9KwY7Hy7GerocRW0+TcbtxtK0FiFsQ@mail.gmail.com>
 <CAPhkiZx=-M8142vgOBhHbNuKqU1TFiPSA8YOpDcWpGTQwiQh8Q@mail.gmail.com> <CAGa2bXa=4nv0D3=7MhrzYbDYMvryG38fgbgpL=tR6sBw5hMjUQ@mail.gmail.com>
Date: Mon, 30 Jul 2018 12:51:30 +0300
Message-ID: <CAPhkiZyhO1szJgXFnOGzsMb7owAPy0YffrJbGT5YgmLbJK_pSA@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: Niklas Keller <me@kelunik.com>, =?UTF-8?Q?Pedro_Magalh=C3=A3es?= <mail@pmmaga.net>, 
	"Frederik Bosch | Genkgo" <f.bosch@genkgo.nl>, Stas Malyshev <smalyshev@gmail.com>, 
	PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset="UTF-8"
Subject: Re: [PHP-DEV] [VOTE] Same Site Cookie RFC
From: narf@devilix.net (Andrey Andreev)

On Mon, Jul 30, 2018 at 5:46 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> On Sun, Jul 29, 2018 at 9:27 PM Andrey Andreev <narf@devilix.net> wrote:
>>
>> Hi,
>>
>> On Sun, Jul 29, 2018 at 7:22 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
>> >
>> > One thing regarding implementation.
>> > Since the internet RFC has only 2 values for "samesite", the parameter
>> > can
>> > be
>> > bool rather than string so that users can avoid "broken security by a
>> > typo".
>> > If "samesite" has more than 2 values, the INI handler can be changed so
>> > that
>> > it can
>> > handle both bool and string parameters.
>> >
>>
>> The attribute has 2 possible values, but those are 2 different modes
>> of operation *when enabled*, not 2 states in total. It doesn't fit in
>> a boolean, and even if it did it wouldn't be forward-compatible that
>> way.
>
>
> What do you mean by "those are 2 different modes
> of operation *when enabled*, not 2 states in total. "?
>
> samesite-value = "Strict" / "Lax"
>
> Flag is flag. It does not matter if it is used as combined values.
>
> An INI value can be bool and string/etc. Even when 3rd value is added, it
> can
> be supported. Such INIs exist in PHP already.
>

A boolean makes sense for Secure and HTTPonly, where the flag either
exists or not. That's not what we have here, as SameSite=Lax is not
the same thing as not having SameSite at all.

bool(false) may make sense as an Off switch, yes, but that's not what
you suggested ...

Cheers,
Andrey.