Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:103045
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain ohgaki.net designates 180.42.98.130 as permitted sender)
MIME-Version: 1.0
References: <a4189866-23ea-4dc5-12a4-a7fbad8e5601@genkgo.nl>
 <1abd260d-ebc4-a062-3381-72485946e8bc@gmail.com> <a55b37e3-268c-f8ab-6545-6cf7a4f537f0@genkgo.nl>
 <CAJd4=Ya67XaX3bwwQn20GUQqEvEVe8XEepRz9+of6h4t4fC_fg@mail.gmail.com>
 <CAPhkiZzSfwMd7TthF7jcWwY+JTnFyamyevnWDZZhGGF_qpEpKA@mail.gmail.com>
 <CAJd4=YZfMgJ7pLwUx_0GqdV+KMCGqYZFhQEDV_2KTMOKiRi6dA@mail.gmail.com>
 <CAPhkiZyHTy8m8N9f531GTMcNNhWO7Rj0U9vtMXzg3FhGyJQ0Vg@mail.gmail.com>
 <CANUQDCjam10D2SANrXQBCau8wAKQyD2gXZO7Q2fiKYQHDOhUzQ@mail.gmail.com>
 <CAJd4=YboTqF5_rUy=YhB8xNV_K=1rrkTNLg+dr1MOQrLxNmdBQ@mail.gmail.com>
 <CANUQDCjp1zMtPYX5eQmTBEdU0UmnVNiaYiXO-R9EZSztQnr4UA@mail.gmail.com>
 <CAGa2bXbhKowGjj5i9DSg9KwY7Hy7GerocRW0+TcbtxtK0FiFsQ@mail.gmail.com>
 <CAPhkiZx=-M8142vgOBhHbNuKqU1TFiPSA8YOpDcWpGTQwiQh8Q@mail.gmail.com>
 <CAGa2bXa=4nv0D3=7MhrzYbDYMvryG38fgbgpL=tR6sBw5hMjUQ@mail.gmail.com>
 <CAPhkiZyhO1szJgXFnOGzsMb7owAPy0YffrJbGT5YgmLbJK_pSA@mail.gmail.com> <CAGa2bXZaH6eSNWQxNG_zeLdYd_+T46kDh2p96sqqp=6U21bpew@mail.gmail.com>
In-Reply-To: <CAGa2bXZaH6eSNWQxNG_zeLdYd_+T46kDh2p96sqqp=6U21bpew@mail.gmail.com>
Date: Mon, 6 Aug 2018 17:55:51 +0900
Message-ID: <CAGa2bXZoVBozpUWPRH67GmoT9PEko1LnmqNMxMST5BG7XSKOMA@mail.gmail.com>
To: Andrey Andreev <narf@devilix.net>
Cc: Niklas Keller <me@kelunik.com>, mail@pmmaga.net, f.bosch@genkgo.nl, 
	Stas Malyshev <smalyshev@gmail.com>, PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000f0c0310572c073d9"
Subject: Re: [PHP-DEV] [VOTE] Same Site Cookie RFC
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--000000000000f0c0310572c073d9
Content-Type: text/plain; charset="UTF-8"

On Mon, Aug 6, 2018 at 5:53 PM Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

>
>
> On Mon, Jul 30, 2018 at 6:51 PM Andrey Andreev <narf@devilix.net> wrote:
>
>> On Mon, Jul 30, 2018 at 5:46 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
>> > On Sun, Jul 29, 2018 at 9:27 PM Andrey Andreev <narf@devilix.net>
>> wrote:
>> >>
>> >> Hi,
>> >>
>> >> On Sun, Jul 29, 2018 at 7:22 AM, Yasuo Ohgaki <yohgaki@ohgaki.net>
>> wrote:
>> >> >
>> >> > One thing regarding implementation.
>> >> > Since the internet RFC has only 2 values for "samesite", the
>> parameter
>> >> > can
>> >> > be
>> >> > bool rather than string so that users can avoid "broken security by a
>> >> > typo".
>> >> > If "samesite" has more than 2 values, the INI handler can be changed
>> so
>> >> > that
>> >> > it can
>> >> > handle both bool and string parameters.
>> >> >
>> >>
>> >> The attribute has 2 possible values, but those are 2 different modes
>> >> of operation *when enabled*, not 2 states in total. It doesn't fit in
>> >> a boolean, and even if it did it wouldn't be forward-compatible that
>> >> way.
>> >
>> >
>> > What do you mean by "those are 2 different modes
>> > of operation *when enabled*, not 2 states in total. "?
>> >
>> > samesite-value = "Strict" / "Lax"
>> >
>> > Flag is flag. It does not matter if it is used as combined values.
>> >
>> > An INI value can be bool and string/etc. Even when 3rd value is added,
>> it
>> > can
>> > be supported. Such INIs exist in PHP already.
>> >
>>
>> A boolean makes sense for Secure and HTTPonly, where the flag either
>> exists or not. That's not what we have here, as SameSite=Lax is not
>> the same thing as not having SameSite at all.
>>
>> bool(false) may make sense as an Off switch, yes, but that's not what
>> you suggested ...
>>
>
>
> Bool actually have 3 values.
>

Simple INI handler can do this, precisely.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--000000000000f0c0310572c073d9--