Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:99895
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.214.54 as permitted sender)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\))
In-Reply-To: <e1483954-5542-fa54-c7eb-a742908af40c@rhsoft.net>
Date: Tue, 18 Jul 2017 08:38:53 -0500
Cc: internals@lists.php.net
Content-Transfer-Encoding: quoted-printable
Message-ID: <BF31715F-1B73-4A8B-8812-3E2D6AF28E12@gmail.com>
References: <14052ebf-efea-cb43-39e0-bdc30e493ff3@genkgo.nl>
 <CAPhkiZyn-nVS1ngds2SgYG3oAebtJkQOaJxOccD1eoCrvvcmJQ@mail.gmail.com>
 <08f6d5f1-a7e7-90a3-1b6a-ac353498cef8@genkgo.nl>
 <e1483954-5542-fa54-c7eb-a742908af40c@rhsoft.net>
To: "lists@rhsoft.net" <lists@rhsoft.net>
Subject: Re: [PHP-DEV] [RFC] samesite cookie implementation
From: pmjones88@gmail.com (Paul Jones)


> On Jul 18, 2017, at 08:37, lists@rhsoft.net wrote:
>=20
>=20
>=20
> Am 18.07.2017 um 15:23 schrieb Frederik Bosch | Genkgo:
>> Hi Andrey,
>> Thanks for your feedback. If we are going to wait for =
http_cookie_set, then my guess will be that it will take a while before =
we see samesite cookie implemented. While I totally agree there is need =
for a new function with a better API, I fail to see why that would mean =
we cannot have a samesite argument in the set(raw)cookie functions now. =
The RFC is in line with the design of these functions.
>> With regard to browsers not implementing it, let me quote the =
currrent documentation on the httponly argument. "It has been suggested =
that this setting can effectively help to reduce identity theft through =
XSS attacks (although it is not supported by all browsers), but that =
claim is often disputed." Basically it says that it is not supported by =
all browsers, but provides help reducing XSS attacks. I don't see the =
difference with samesite.
>=20
> which browser in 2017 does not support 'httponly'?
> that was true a decade ago, now that parapgraph in the docs is just =
FUD

(/me nods)

Perhaps the same will be true for "samesite".


--=20
Paul M. Jones
pmjones88@gmail.com
http://paul-m-jones.com

Modernizing Legacy Applications in PHP
https://leanpub.com/mlaphp

Solving the N+1 Problem in PHP
https://leanpub.com/sn1php