Skip to content

SameSite not supported by Symfony 3.4 LTS on PHP 7.4.2 #35520

Closed
@jayesbe

Description

@jayesbe

Symfony version(s) affected: 3.4.36

Description
Chrome is currently throwing a warning:

A cookie associated with a cross-site resource at was set without the SameSite attribute. A future release of Chrome will only deliver cookies with cross-site requests if they are set with SameSite=None and Secure.

How to reproduce

  session:
      # storage_id: app.dynamic.session.storage
      handler_id: ~
      name: "%session.name%"
      cookie_secure: true
      cookie_httponly: true
      cookie_lifetime: 2630000 # 1-Month
      cookie_samesite: strict

Add the cookie_samesite option. The value does not matter as adding the option results in

Unrecognized option "cookie_samesite" under "framework.session"

Possible Solution

Additional context

Symfony 3.4 LTS is still a maintained branch, SameSite is now going into affect in browsers with Chrome expected to deploy soon. I am currently trying to implement this

https://www.chromium.org/updates/same-site/incompatible-clients

which is supposed to help determine when SameSite is required. Without Symfony 3.4 LTS support, this isn't possible.

The application is being deployed to a Ubuntu 18.04 LTS server with PHP 7.4.2.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions