You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The `samesite` attribute is set on all cookies with a default value of `Lax`. You can change the default value by setting the `default_samesite` value on the
62
+
[Cookie](api:SilverStripe\Control\Cookie) class:
63
+
64
+
```yml
65
+
SilverStripe\Control\Cookie:
66
+
default_samesite: 'Strict'
67
+
```
68
+
69
+
If you need to set the `samesite` attribute for a specific cookie, you can implement the `updateSameSite()` method on an `Extension` subclass and apply that to
70
+
[CookieJar](api:SilverStripe\Control\CookieJar) - though note that this extension method will stop working in 5.0 in favour of a new parameter for passing the
71
+
`samesite`attribute value directly.
72
+
73
+
```yml
74
+
SilverStripe\Control\CookieJar:
75
+
extensions:
76
+
- App\Extension\CookieJarExtension
77
+
```
78
+
79
+
```php
80
+
<?php
81
+
82
+
use SilverStripe\Core\Extension;
83
+
84
+
namespace App\Extension;
85
+
86
+
class CookieJarExtension extends Extension
87
+
{
88
+
public function updateSameSite(string $cookieName, string $sameSite): void
89
+
{
90
+
if ($cookieName === 'my-cookie') {
91
+
$sameSite = 'Lax';
92
+
}
93
+
}
94
+
}
95
+
```
96
+
55
97
## Cookie_Backend
56
98
57
99
The [Cookie](api:SilverStripe\Control\Cookie) class manipulates and sets cookies using a [Cookie_Backend](api:SilverStripe\Control\Cookie_Backend). The backend is in charge of the logic
Copy file name to clipboardexpand all lines: docs/en/02_Developer_Guides/18_Cookies_And_Sessions/02_Sessions.md
+15-1
Original file line number
Diff line number
Diff line change
@@ -101,7 +101,19 @@ including form and page comment information. None of this is vital but `clear_al
101
101
$session->clearAll();
102
102
```
103
103
104
-
## Secure Session Cookie
104
+
## Cookies
105
+
106
+
### Samesite attribute
107
+
108
+
The session cookie is handled slightly differently than most cookies on the site, which provides the opportunity to handle the samesite attribute separately from other cookies.
109
+
It will respect the default value, but you can also set a `samesite` attribute that differs from the default:
110
+
111
+
```yml
112
+
SilverStripe\Control\Session:
113
+
cookies_samesite: 'Strict'
114
+
```
115
+
116
+
### Secure Session Cookie
105
117
106
118
In certain circumstances, you may want to use a different `session_name` cookie when using the `https` protocol for security purposes. To do this, you may set the `cookie_secure` parameter to `true` on your `config.yml`
107
119
@@ -113,6 +125,8 @@ SilverStripe\Control\Session:
113
125
114
126
This uses the session_name `SECSESSID` for `https` connections instead of the default `PHPSESSID`. Doing so adds an extra layer of security to your session cookie since you no longer share `http` and `https` sessions.
115
127
128
+
Note that if you set `cookies_samesite` to `None` (which is _strongly_ discouraged), the `cookie_secure` value will _always_ be `true`.
129
+
116
130
## Relaxing checks around user agent strings
117
131
118
132
Out of the box, Silverstripe CMS will invalidate a user's session if the `User-Agent` header changes. This provides some supplemental protection against session high-jacking attacks.
-[Features and enhancements](#features-and-enhancements)
11
+
-[Samesite attribute on cookies](#cookies-samesite)
12
+
-[Other features](#other-features)
13
+
-[Bugfixes](#bugfixes)
14
+
15
+
## Regression test and Security audit{#audit}
16
+
17
+
This release has been comprehensively regression tested and passed to a third party for a security-focused audit.
18
+
19
+
While it is still advised that you perform your own due diligence when upgrading your project, this work is performed to ensure a safe and secure upgrade with each recipe release.
20
+
21
+
## Features and enhancements {#features-and-enhancements}
22
+
23
+
### Samesite attribute on cookies {#cookies-samesite}
24
+
25
+
The `samesite` attribute is now set on all cookies. To avoid backward compatability issues, the `Lax` value has been set by default, but we recommend reviewing the requirements of your project and setting an appropriate value.
26
+
27
+
The default value can be set for all cookies in yaml configuration like so:
28
+
29
+
```yml
30
+
SilverStripe\Control\Cookie:
31
+
default_samesite: 'Strict'
32
+
```
33
+
34
+
If you need to set the `samesite` attribute for a specific cookie, you can do that too. Check out the [cookies documentation](/developer_guides/cookies_and_sessions/cookies#samesite-attribute) for more information.
35
+
36
+
The session cookie is handled separately. It will respect the default value above, but you can also configure it with its own value like so:
37
+
38
+
```yml
39
+
SilverStripe\Control\Session:
40
+
cookies_samesite: 'Strict'
41
+
```
42
+
43
+
Note that if you set the `samesite` attribute to `None`, the `secure` is automatically set to `true` as required by the specification.
44
+
45
+
For more information about the `samesite` attribute check out https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
46
+
47
+
### Other new features {#other-features}
48
+
49
+
## Bugfixes {#bugfixes}
50
+
51
+
This release includes a number of bug fixes to improve a broad range of areas. Check the change logs for full details of these fixes split by module. Thank you to the community members that helped contribute these fixes as part of the release!
52
+
53
+
<!--- Changes below this line will be automatically regenerated -->
54
+
55
+
<!--- Changes above this line will be automatically regenerated -->
0 commit comments