Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:119319
Content-Type: text/plain;
	charset=utf-8
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3731.300.101.1.3\))
Date: Wed, 18 Jan 2023 17:08:45 +0100
References: <CAFPFaM+d_1pV__2u+rkTEOF8mPM_CSXRk3udmG-+G1oVuKbQmg@mail.gmail.com>
 <CAOWwgpnJrHfx83wkd35J_9HwqzkB-1iRfTyqYbZ=7HB9nUhrhQ@mail.gmail.com>
 <CAFPFaMKTaQDSJXFfos=3sdL7ddSrje_aHWcg67GA9jXPe8uhew@mail.gmail.com>
 <22D992B7-62B3-4A4F-934F-17D53058FD35@cschneid.com>
 <CAFPFaM+M-g+YmsTaxzq9c-94AGNL=coxbtu4nn4ryvOPUtfsTg@mail.gmail.com>
 <138CAD88-013E-40C7-8F0F-2034A7B0980B@cschneid.com>
 <alpine.DEB.2.23.453.2301181514440.23089@singlemalt.home.derickrethans.nl>
 <5A9A769C-C0B5-40CB-9BAD-8FD0A9C31794@gmail.com>
To: PHP internals <internals@lists.php.net>
In-Reply-To: <5A9A769C-C0B5-40CB-9BAD-8FD0A9C31794@gmail.com>
Message-ID: <7802BE75-1026-42AE-B4B0-E2FA9D243B1C@cschneid.com>
Subject: Re: [PHP-DEV] [RFC] Add SameSite cookie attribute parameter
From: cschneid@cschneid.com (Christian Schneider)

Am 18.01.2023 um 16:26 schrieb Claude Pache <claude.pache@gmail.com>:
>> Le 18 janv. 2023 =C3=A0 16:20, Derick Rethans <derick@php.net> a =
=C3=A9crit :
>>=20
>> if (version_compare(phpversion(), "8.4.0", ">")) {
>> setcookie("test", "value", samesite: SameSite::Stricter);
>> } else {
>> setcookie("test", "value", samesite: SameSite::Strict);
>> }
>=20
> Or even, replace `version_compare(...)` with `SameSite::tryFrom(...) =
!=3D=3D null`:
> setcookie("test", "value", samesite: SameSite::tryFrom('Stricter') ?? =
SameSite::Strict);

Thanks for your replies, I like the second option as it is a feature =
instead of a version check.

Now my only itch is that the support for SameSite=3DStricter is actually =
depending on the browser, not the server so assuming all browser are =
already supporting this new mode I should not send a less strict mode =
just because I'm using an old PHP version. This is currently possible =
since setcookie() does not validate the content of the samesite options.
But as this is somewhat of a special case (most function options do not =
depend on something external) and you seem to be confident that the list =
of SameSite options will not change any time soon I'll shut up now :-)

Regards,
- Chris