No support for SameSite cookie directive

[dhensby]

Affected Version

All versions

Description

Cookies support an additional directive SameSite which we have no way of supporting in the current Cookie implementation (due to lack of parameters).

This is a problem because sites running over HTTPS and in iframes need to explicitly set this directive otherwise the cookies are not set (including session cookies).

Further support for SameSite in php's cookie functions has been added in 7.3.0, so anyone running older versions of PHP is going to struggle unless we completely rework how we set cookies.

Further info https://web.dev/samesite-cookies-explained/

I've managed to hack this together on a site of mine to make sure it works, but it does involve disabling PHP's native cookie handling for sessions and also manually setting cookies via adding set-cookie headers rather than using PHP's setcookie API.

Acceptance criteria

• Feedback on Matt's PR is addressed
• People can opt-in to use this feature in when setting their cookies (i.e. set a different value other than the default)
• Sensible explicit default value is provided (Lax, Strict or none)
• Relevant doc is updated

Pull requests

• ENH Add samesite attribute to cookies. #10335

[maxime-rainville]

Seems like Matt's solution is pretty close to done. Might be worth taking this through a quick grooming to figure out what we want to do with it.

[GuySartorelli]

Matt's solution could have backwards compatibility concerns - there's another PR #9920 which takes the approach using config instead. I'm going to base a new PR off this, and in review we can discuss the merits and fallbacks.

I think for now having the ability to configure some value is better than nothing, and I'd like to avoid breaking anyone's custom cookie code (if, for example, someone implemented this in their own project, they may be subclassing some of our cookie classes and overriding the public methods, so any new parameters there would break their site). Adding it as a parameter would be a good exercise for a major.