Add documentation on cookie_samesite setting in FrameworkBundle #10202
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
fabpot
reviewed
Sep 4, 2018
| ~~~~~~~~~~~~~~~~~~~~~~~ | ||
|
|
||
| .. versionadded:: 4.2 | ||
| The option to use SameSite cookies for session was introduced in 4.2. |
| .. versionadded:: 4.2 | ||
| The option to use SameSite cookies for session was introduced in 4.2. | ||
|
|
||
| SameSite cookies are a measure to protect against Cross Site Forgery Request (CSRF) attacks by preventing the cookies to be sent to the server if a request was not originated from the domain the cookies are for. |
There was a problem hiding this comment.
Text should be at around 80 chars
symfony-splitter
pushed a commit
to symfony/framework-bundle
that referenced
this pull request
Sep 4, 2018
This PR was merged into the 4.2-dev branch. Discussion ---------- Add SameSite cookies to FrameWorkBundle | Q | A | ------------- | --- | Branch? | master | Bug fix? | no | New feature? | yes, and added to changelog https://github.com/symfony/symfony/pull/28168/files#diff-276f5b13978c2ce3f555b9603f44801aR21 | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | #27631 | License | MIT | Doc PR | symfony/symfony-docs#10202 Uses `session.cookie_samesite` for PHP >= 7.3. For PHP < 7.3 it first does a session_start(), find the emitted header, changes it, and emits it again with the value for SameSite added. I also tried it in a minimal Symfony 4.1 app, and works there too:  Commits ------- 4091feb693 Add SameSite cookies to FrameWorkBundle
fabpot
added a commit
to symfony/symfony
that referenced
this pull request
Sep 4, 2018
This PR was merged into the 4.2-dev branch. Discussion ---------- Add SameSite cookies to FrameWorkBundle | Q | A | ------------- | --- | Branch? | master | Bug fix? | no | New feature? | yes, and added to changelog https://github.com/symfony/symfony/pull/28168/files#diff-276f5b13978c2ce3f555b9603f44801aR21 | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | #27631 | License | MIT | Doc PR | symfony/symfony-docs#10202 Uses `session.cookie_samesite` for PHP >= 7.3. For PHP < 7.3 it first does a session_start(), find the emitted header, changes it, and emits it again with the value for SameSite added. I also tried it in a minimal Symfony 4.1 app, and works there too:  Commits ------- 4091feb Add SameSite cookies to FrameWorkBundle
|
@rpkamp thanks a lot for contributing this feature and its docs. It's a really important feature because PHP 7.3 is adding support for it as well as all modern browsers. Sadly, this pull request needed some important changes ... so I opened #10258 to replace it. The main issue is that this is a config option of Symfony full-stack apps ... so we can't explain it in the components doc (I know, it may be confusing ... we're trying to change this). Also, given that it's a very recent feature, we decided to explain it a bit more so readers can make a better choice for this option. In any case, thanks again for your contribution! |
javiereguiluz
added a commit
that referenced
this pull request
Sep 5, 2018
|
No problem @javiereguiluz. Thanks for taking this on 😄 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Documentation supporting symfony/symfony#28168