Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:99902
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain devilix.net designates 209.85.218.52 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <08f6d5f1-a7e7-90a3-1b6a-ac353498cef8@genkgo.nl>
References: <14052ebf-efea-cb43-39e0-bdc30e493ff3@genkgo.nl>
 <CAPhkiZyn-nVS1ngds2SgYG3oAebtJkQOaJxOccD1eoCrvvcmJQ@mail.gmail.com> <08f6d5f1-a7e7-90a3-1b6a-ac353498cef8@genkgo.nl>
Date: Tue, 18 Jul 2017 17:13:15 +0300
Message-ID: <CAPhkiZzv5zC3VmcNBokhk4qxHdCgnOM7q5jnbHpTvDB=JOvb5g@mail.gmail.com>
To: "Frederik Bosch | Genkgo" <f.bosch@genkgo.nl>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="001a113d77aaddcf240554981d4d"
Subject: Re: [PHP-DEV] [RFC] samesite cookie implementation
From: narf@devilix.net (Andrey Andreev)

--001a113d77aaddcf240554981d4d
Content-Type: text/plain; charset="UTF-8"

Hi again,

On Tue, Jul 18, 2017 at 4:23 PM, Frederik Bosch | Genkgo <f.bosch@genkgo.nl>
wrote:

> Hi Andrey,
>
> Thanks for your feedback. If we are going to wait for http_cookie_set,
> then my guess will be that it will take a while before we see samesite
> cookie implemented. While I totally agree there is need for a new function
> with a better API, I fail to see why that would mean we cannot have a
> samesite argument in the set(raw)cookie functions now. The RFC is in line
> with the design of these functions.
>
I don't know what you mean by "now" ... it's not like it can happen
overnight.

With regard to browsers not implementing it, let me quote the currrent
> documentation on the httponly argument. "It has been suggested that this
> setting can effectively help to reduce identity theft through XSS attacks
> (although it is not supported by all browsers), but that claim is often
> disputed." Basically it says that it is not supported by all browsers, but
> provides help reducing XSS attacks. I don't see the difference with
> samesite.
>
Well, if you insist on comparing the two ...

- HttpOnly was released with PHP 5.2.0 in January 2011 - just 3 months
prior to IETF RFC 6265 (April 2011) becoming a standards track.
- SameSite has only a single IETF draft, which has expired because it's
been inactive for a year.


I too want to see SameSite cookies added to PHP's standard library, but
this is certainly not a thing that needs to happen yesterday. There's no
reason not to wait for the http_cookie_set() proposal.

And I too agree that adding a millionth parameter to setcookie() is the
wrong approach anyway.

Cheers,
Andrey.

--001a113d77aaddcf240554981d4d--