Skip to content

Commit 39baff4

Browse files
frederikboschfrederikbosch
committed
implement same site cookie
see https://bugs.php.net/bug.php?id=72230 see https://tools.ietf.org/html/draft-west-first-party-cookies-07 see https://scotthelme.co.uk/csrf-is-dead/
1 parent 134047d commit 39baff4

12 files changed

+149
-27
lines changed

‎ext/session/php_session.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -157,6 +157,7 @@ typedef struct _php_ps_globals {
157157
char *cookie_domain;
158158
zend_bool cookie_secure;
159159
zend_bool cookie_httponly;
160+
char *cookie_samesite;
160161
ps_module *mod;
161162
ps_module *default_mod;
162163
void *mod_data;

‎ext/session/session.c

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -799,6 +799,7 @@ PHP_INI_BEGIN()
799799
STD_PHP_INI_ENTRY("session.cookie_domain", "", PHP_INI_ALL, OnUpdateSessionString, cookie_domain, php_ps_globals, ps_globals)
800800
STD_PHP_INI_ENTRY("session.cookie_secure", "0", PHP_INI_ALL, OnUpdateSessionBool, cookie_secure, php_ps_globals, ps_globals)
801801
STD_PHP_INI_ENTRY("session.cookie_httponly", "0", PHP_INI_ALL, OnUpdateSessionBool, cookie_httponly, php_ps_globals, ps_globals)
802+
STD_PHP_INI_ENTRY("session.cookie_samesite", "", PHP_INI_ALL, OnUpdateString, cookie_samesite, php_ps_globals, ps_globals)
802803
STD_PHP_INI_ENTRY("session.use_cookies", "1", PHP_INI_ALL, OnUpdateSessionBool, use_cookies, php_ps_globals, ps_globals)
803804
STD_PHP_INI_ENTRY("session.use_only_cookies", "1", PHP_INI_ALL, OnUpdateSessionBool, use_only_cookies, php_ps_globals, ps_globals)
804805
STD_PHP_INI_ENTRY("session.use_strict_mode", "0", PHP_INI_ALL, OnUpdateSessionBool, use_strict_mode, php_ps_globals, ps_globals)
@@ -1357,6 +1358,11 @@ static int php_session_send_cookie(void) /* {{{ */
13571358
smart_str_appends(&ncookie, COOKIE_HTTPONLY);
13581359
}
13591360

1361+
if (PS(cookie_samesite)[0]) {
1362+
smart_str_appends(&ncookie, COOKIE_SAMESITE);
1363+
smart_str_appends(&ncookie, PS(cookie_samesite));
1364+
}
1365+
13601366
smart_str_0(&ncookie);
13611367

13621368
php_session_remove_cookie(); /* remove already sent session ID cookie */
@@ -1655,18 +1661,18 @@ PHPAPI void session_adapt_url(const char *url, size_t urllen, char **new, size_t
16551661
* Userspace exported functions *
16561662
******************************** */
16571663

1658-
/* {{{ proto bool session_set_cookie_params(int lifetime [, string path [, string domain [, bool secure[, bool httponly]]]])
1664+
/* {{{ proto void session_set_cookie_params(int lifetime [, string path [, string domain [, bool secure[, bool httponly[, string samesite]]]]])
16591665
Set session cookie parameters */
16601666
static PHP_FUNCTION(session_set_cookie_params)
16611667
{
16621668
zval *lifetime;
1663-
zend_string *path = NULL, *domain = NULL;
1669+
zend_string *path = NULL, *domain = NULL, *samesite = NULL;
16641670
int argc = ZEND_NUM_ARGS();
16651671
zend_bool secure = 0, httponly = 0;
16661672
zend_string *ini_name;
16671673

16681674
if (!PS(use_cookies) ||
1669-
zend_parse_parameters(argc, "z|SSbb", &lifetime, &path, &domain, &secure, &httponly) == FAILURE) {
1675+
zend_parse_parameters(argc, "z|SSbbS", &lifetime, &path, &domain, &secure, &httponly, &samesite) == FAILURE) {
16701676
return;
16711677
}
16721678

@@ -1724,6 +1730,12 @@ static PHP_FUNCTION(session_set_cookie_params)
17241730
zend_string_release(ini_name);
17251731
}
17261732

1733+
if (argc > 5) {
1734+
ini_name = zend_string_init("session.cookie_samesite", sizeof("session.cookie_samesite") - 1, 0);
1735+
zend_alter_ini_entry(ini_name, samesite, PHP_INI_USER, PHP_INI_STAGE_RUNTIME);
1736+
zend_string_release(ini_name);
1737+
}
1738+
17271739
RETURN_TRUE;
17281740
}
17291741
/* }}} */
@@ -1743,6 +1755,7 @@ static PHP_FUNCTION(session_get_cookie_params)
17431755
add_assoc_string(return_value, "domain", PS(cookie_domain));
17441756
add_assoc_bool(return_value, "secure", PS(cookie_secure));
17451757
add_assoc_bool(return_value, "httponly", PS(cookie_httponly));
1758+
add_assoc_string(return_value, "samesite", PS(cookie_samesite));
17461759
}
17471760
/* }}} */
17481761

@@ -2621,6 +2634,7 @@ ZEND_BEGIN_ARG_INFO_EX(arginfo_session_set_cookie_params, 0, 0, 1)
26212634
ZEND_ARG_INFO(0, domain)
26222635
ZEND_ARG_INFO(0, secure)
26232636
ZEND_ARG_INFO(0, httponly)
2637+
ZEND_ARG_INFO(0, samesite)
26242638
ZEND_END_ARG_INFO()
26252639

26262640
ZEND_BEGIN_ARG_INFO(arginfo_session_class_open, 0)

‎ext/session/tests/session_get_cookie_params_basic.phpt

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ session.cookie_path="/"
88
session.cookie_domain=""
99
session.cookie_secure=0
1010
session.cookie_httponly=0
11+
session.cookie_samesite=""
1112
--FILE--
1213
<?php
1314

@@ -22,17 +23,17 @@ ob_start();
2223
echo "*** Testing session_get_cookie_params() : basic functionality ***\n";
2324

2425
var_dump(session_get_cookie_params());
25-
var_dump(session_set_cookie_params(3600, "/path", "blah", FALSE, FALSE));
26+
var_dump(session_set_cookie_params(3600, "/path", "blah", FALSE, FALSE, "foo"));
2627
var_dump(session_get_cookie_params());
27-
var_dump(session_set_cookie_params(1234567890, "/guff", "foo", TRUE, TRUE));
28+
var_dump(session_set_cookie_params(1234567890, "/guff", "foo", TRUE, TRUE, "blah"));
2829
var_dump(session_get_cookie_params());
2930

3031
echo "Done";
3132
ob_end_flush();
3233
?>
3334
--EXPECTF--
3435
*** Testing session_get_cookie_params() : basic functionality ***
35-
array(5) {
36+
array(6) {
3637
["lifetime"]=>
3738
int(0)
3839
["path"]=>
@@ -43,9 +44,11 @@ array(5) {
4344
bool(false)
4445
["httponly"]=>
4546
bool(false)
47+
["samesite"]=>
48+
string(0) ""
4649
}
4750
bool(true)
48-
array(5) {
51+
array(6) {
4952
["lifetime"]=>
5053
int(3600)
5154
["path"]=>
@@ -56,9 +59,11 @@ array(5) {
5659
bool(false)
5760
["httponly"]=>
5861
bool(false)
62+
["samesite"]=>
63+
string(3) "foo"
5964
}
6065
bool(true)
61-
array(5) {
66+
array(6) {
6267
["lifetime"]=>
6368
int(1234567890)
6469
["path"]=>
@@ -69,5 +74,7 @@ array(5) {
6974
bool(true)
7075
["httponly"]=>
7176
bool(true)
77+
["samesite"]=>
78+
string(4) "blah"
7279
}
7380
Done

‎ext/session/tests/session_get_cookie_params_variation1.phpt

Lines changed: 35 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ session.cookie_path="/"
88
session.cookie_domain=""
99
session.cookie_secure=0
1010
session.cookie_httponly=0
11+
session.cookie_samesite=""
1112
--FILE--
1213
<?php
1314

@@ -32,13 +33,15 @@ ini_set("session.cookie_secure", TRUE);
3233
var_dump(session_get_cookie_params());
3334
ini_set("session.cookie_httponly", TRUE);
3435
var_dump(session_get_cookie_params());
36+
ini_set("session.cookie_samesite", "foo");
37+
var_dump(session_get_cookie_params());
3538

3639
echo "Done";
3740
ob_end_flush();
3841
?>
3942
--EXPECTF--
4043
*** Testing session_get_cookie_params() : variation ***
41-
array(5) {
44+
array(6) {
4245
["lifetime"]=>
4346
int(0)
4447
["path"]=>
@@ -49,8 +52,10 @@ array(5) {
4952
bool(false)
5053
["httponly"]=>
5154
bool(false)
55+
["samesite"]=>
56+
string(0) ""
5257
}
53-
array(5) {
58+
array(6) {
5459
["lifetime"]=>
5560
int(3600)
5661
["path"]=>
@@ -61,8 +66,10 @@ array(5) {
6166
bool(false)
6267
["httponly"]=>
6368
bool(false)
69+
["samesite"]=>
70+
string(0) ""
6471
}
65-
array(5) {
72+
array(6) {
6673
["lifetime"]=>
6774
int(3600)
6875
["path"]=>
@@ -73,8 +80,10 @@ array(5) {
7380
bool(false)
7481
["httponly"]=>
7582
bool(false)
83+
["samesite"]=>
84+
string(0) ""
7685
}
77-
array(5) {
86+
array(6) {
7887
["lifetime"]=>
7988
int(3600)
8089
["path"]=>
@@ -85,8 +94,10 @@ array(5) {
8594
bool(false)
8695
["httponly"]=>
8796
bool(false)
97+
["samesite"]=>
98+
string(0) ""
8899
}
89-
array(5) {
100+
array(6) {
90101
["lifetime"]=>
91102
int(3600)
92103
["path"]=>
@@ -97,8 +108,10 @@ array(5) {
97108
bool(true)
98109
["httponly"]=>
99110
bool(false)
111+
["samesite"]=>
112+
string(0) ""
100113
}
101-
array(5) {
114+
array(6) {
102115
["lifetime"]=>
103116
int(3600)
104117
["path"]=>
@@ -109,6 +122,22 @@ array(5) {
109122
bool(true)
110123
["httponly"]=>
111124
bool(true)
125+
["samesite"]=>
126+
string(0) ""
127+
}
128+
array(6) {
129+
["lifetime"]=>
130+
int(3600)
131+
["path"]=>
132+
string(5) "/path"
133+
["domain"]=>
134+
string(3) "foo"
135+
["secure"]=>
136+
bool(true)
137+
["httponly"]=>
138+
bool(true)
139+
["samesite"]=>
140+
string(3) "foo"
112141
}
113142
Done
114143

‎ext/session/tests/session_set_cookie_params_variation3.phpt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ session.cookie_domain=foo
1010
ob_start();
1111

1212
/*
13-
* Prototype : void session_set_cookie_params(int $lifetime [, string $path [, string $domain [, bool $secure [, bool $httponly]]]])
13+
* Prototype : void session_set_cookie_params(int $lifetime [, string $path [, string $domain [, bool $secure [, bool $httponly[, string $samesite]]]]])
1414
* Description : Set the session cookie parameters
1515
* Source code : ext/session/session.c
1616
*/

‎ext/session/tests/session_set_cookie_params_variation5.phpt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ session.cookie_httponly=TRUE
1010
ob_start();
1111

1212
/*
13-
* Prototype : void session_set_cookie_params(int $lifetime [, string $path [, string $domain [, bool $secure [, bool $httponly]]]])
13+
* Prototype : void session_set_cookie_params(int $lifetime [, string $path [, string $domain [, bool $secure [, bool $httponly[, string $samesite]]]]])
1414
* Description : Set the session cookie parameters
1515
* Source code : ext/session/session.c
1616
*/

‎ext/session/tests/session_set_cookie_params_variation6.phpt

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
--TEST--
2+
Test session_set_cookie_params() function : variation
3+
--INI--
4+
session.cookie_samesite=test
5+
--SKIPIF--
6+
<?php include('skipif.inc'); ?>
7+
--FILE--
8+
<?php
9+
10+
ob_start();
11+
12+
/*
13+
* Prototype : void session_set_cookie_params(int $lifetime [, string $path [, string $domain [, bool $secure [, bool $samesite[, string $samesite]]]]])
14+
* Description : Set the session cookie parameters
15+
* Source code : ext/session/session.c
16+
*/
17+
18+
echo "*** Testing session_set_cookie_params() : variation ***\n";
19+
20+
var_dump(ini_get("session.cookie_samesite"));
21+
var_dump(session_set_cookie_params(3600, "/path", "blah", FALSE, FALSE, "nothing"));
22+
var_dump(ini_get("session.cookie_samesite"));
23+
var_dump(session_start());
24+
var_dump(ini_get("session.cookie_samesite"));
25+
var_dump(session_set_cookie_params(3600, "/path", "blah", FALSE, TRUE, "test"));
26+
var_dump(ini_get("session.cookie_samesite"));
27+
var_dump(session_destroy());
28+
var_dump(ini_get("session.cookie_samesite"));
29+
var_dump(session_set_cookie_params(3600, "/path", "blah", FALSE, FALSE, "other"));
30+
var_dump(ini_get("session.cookie_samesite"));
31+
32+
echo "Done";
33+
ob_end_flush();
34+
?>
35+
--EXPECTF--
36+
*** Testing session_set_cookie_params() : variation ***
37+
string(4) "test"
38+
bool(true)
39+
string(7) "nothing"
40+
bool(true)
41+
string(7) "nothing"
42+
43+
Warning: session_set_cookie_params(): Cannot change session cookie parameters when session is active in %s on line 18
44+
bool(false)
45+
string(7) "nothing"
46+
bool(true)
47+
string(7) "nothing"
48+
bool(true)
49+
string(5) "other"
50+
Done

‎ext/standard/basic_functions.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1425,6 +1425,7 @@ ZEND_BEGIN_ARG_INFO_EX(arginfo_setcookie, 0, 0, 1)
14251425
ZEND_ARG_INFO(0, domain)
14261426
ZEND_ARG_INFO(0, secure)
14271427
ZEND_ARG_INFO(0, httponly)
1428+
ZEND_ARG_INFO(0, samesite)
14281429
ZEND_END_ARG_INFO()
14291430

14301431
ZEND_BEGIN_ARG_INFO_EX(arginfo_setrawcookie, 0, 0, 1)
@@ -1435,6 +1436,7 @@ ZEND_BEGIN_ARG_INFO_EX(arginfo_setrawcookie, 0, 0, 1)
14351436
ZEND_ARG_INFO(0, domain)
14361437
ZEND_ARG_INFO(0, secure)
14371438
ZEND_ARG_INFO(0, httponly)
1439+
ZEND_ARG_INFO(0, samesite)
14381440
ZEND_END_ARG_INFO()
14391441

14401442
ZEND_BEGIN_ARG_INFO_EX(arginfo_headers_sent, 0, 0, 0)

0 commit comments

Comments
 (0)