Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:119271
Content-Type: text/plain;
	charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.7\))
In-Reply-To: <CAFPFaM+d_1pV__2u+rkTEOF8mPM_CSXRk3udmG-+G1oVuKbQmg@mail.gmail.com>
Date: Sun, 15 Jan 2023 22:08:55 +0100
Cc: PHP internals <internals@lists.php.net>
Content-Transfer-Encoding: quoted-printable
Message-ID: <C1248D69-4A6A-4753-B19C-2E5F3A81FD4A@gmail.com>
References: <CAFPFaM+d_1pV__2u+rkTEOF8mPM_CSXRk3udmG-+G1oVuKbQmg@mail.gmail.com>
To: "G. P. B." <george.banyard@gmail.com>
Subject: Re: [PHP-DEV] [RFC] Add SameSite cookie attribute parameter
From: claude.pache@gmail.com (Claude Pache)



> Le 14 janv. 2023 =C3=A0 16:14, G. P. B. <george.banyard@gmail.com> a =
=C3=A9crit :
>=20
> Hello Internals,
>=20
> I would like to start the discussion about the Add SameSite cookie
> attribute parameter RFC:
> https://wiki.php.net/rfc/same-site-parameter
>=20
> This proposes to add an optional same site parameter to the =
setrawcooki(),
> setcookie() and session_set_cookie_params() that takes a a value a new
> SameSite enum:
>=20
> enum SameSite {
>    case None;
>    case Lax;
>    case Strict;}
>=20
>=20
> Best regards,
>=20
> George P. Banyard

Hi,

Some technical remarks:
* The new parameter name should be `$samesite` (all lowercase), in order =
to match with the casing of the corresponding key in `$options`.
* I think that you should add the case `SameSite::Omit` (which is the =
current default). This is not only for BC, but also for FC if, for some =
reason, `SameSite: Lax` is replaced by some attribute that supersedes =
it. Or if `SameSite: Lax` becomes the default, and therefore redundant. =
=E2=80=94 Having `SameSite::Omit` instead of `null` would mean that it =
would be difficult to miss it by accident.

That said, I am much more interested in being able to add custom cookie =
attributes. Back when SameSite was introduced (on the web, not in PHP), =
I recall that I had to use some hack in order to include them in my =
session cookie (before upgrading to PHP 7.3). The new cookie attributes =
mentioned by Nicolas in the other mail are probably too experimental in =
order to support them officially, but it could be interesting to be able =
to include them nonetheless, e.g. using some `customAttributes` =
parameter.

=E2=80=94Claude=