Description
Symfony version(s) affected: 3.4.36
Description
Chrome is currently throwing a warning:
A cookie associated with a cross-site resource at was set without the SameSite attribute. A future release of Chrome will only deliver cookies with cross-site requests if they are set with SameSite=None and Secure.
How to reproduce
session:
# storage_id: app.dynamic.session.storage
handler_id: ~
name: "%session.name%"
cookie_secure: true
cookie_httponly: true
cookie_lifetime: 2630000 # 1-Month
cookie_samesite: strict
Add the cookie_samesite option. The value does not matter as adding the option results in
Unrecognized option "cookie_samesite" under "framework.session"
Possible Solution
Additional context
Symfony 3.4 LTS is still a maintained branch, SameSite is now going into affect in browsers with Chrome expected to deploy soon. I am currently trying to implement this
https://www.chromium.org/updates/same-site/incompatible-clients
which is supposed to help determine when SameSite is required. Without Symfony 3.4 LTS support, this isn't possible.
The application is being deployed to a Ubuntu 18.04 LTS server with PHP 7.4.2.