Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:119270
Content-Type: text/plain;
	charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3731.300.101.1.3\))
Date: Sun, 15 Jan 2023 21:58:41 +0100
References: <CAFPFaM+d_1pV__2u+rkTEOF8mPM_CSXRk3udmG-+G1oVuKbQmg@mail.gmail.com>
To: PHP internals <internals@lists.php.net>
In-Reply-To: <CAFPFaM+d_1pV__2u+rkTEOF8mPM_CSXRk3udmG-+G1oVuKbQmg@mail.gmail.com>
Message-ID: <05489B2A-0BD4-4427-9279-DE3E02387B57@cschneid.com>
Subject: Re: [PHP-DEV] [RFC] Add SameSite cookie attribute parameter
From: cschneid@cschneid.com (Christian Schneider)

Am 14.01.2023 um 16:14 schrieb G. P. B. <george.banyard@gmail.com>:
> I would like to start the discussion about the Add SameSite cookie
> attribute parameter RFC:
> https://wiki.php.net/rfc/same-site-parameter
>=20
> This proposes to add an optional same site parameter to the =
setrawcooki(),
> setcookie() and session_set_cookie_params() that takes a a value a new
> SameSite enum:
>=20
> enum SameSite {
>    case None;
>    case Lax;
>    case Strict;}


Some comments:
- I am not convinced that we should introduce a third way of providing =
parameters to setcookie(). I don't think this function is used often =
enough in common code to add yet another iteration of the API. Assuming =
there is 1 to 2 places in your framework using this I don't think many =
bugs will go unnoticed. Adding a warning to illegal 'samesite' values in =
$options would IMHO be enough if stricter checking is wished for.
- I don't like the camelCase of $sameSite as this is different from all =
the other parameters, e.g. $expires_or_options (yes, this is a =
pseudo-parameter name, I know) and $httponly. Looking at a couple of =
functions in the standard PHP set I didn't see any $camelCase.
- A more generic question: How are Enums handled concerning future =
additions of values vs. BC compatibility? What is the migration plan =
there if one wants to support both old and new PHP versions?

Regards,
- Chris