Fixes #2157, Explicitly set SameSite value for cookies

composer.json

@@ -38,7 +38,7 @@
         "php": ">=7.2",
         "axy/sourcemap": "^0.1.4",
         "components/font-awesome": "5.9.*",
-        "dflydev/fig-cookies": "^1.0.2",
+        "dflydev/fig-cookies": "^2.0.1",
         "doctrine/dbal": "^2.7",
         "franzl/whoops-middleware": "^0.4.0",
         "illuminate/bus": "5.7.*",

src/Http/CookieFactory.php

@@ -9,6 +9,7 @@
 
 namespace Flarum\Http;
 
+use Dflydev\FigCookies\Modifier\SameSite;
 use Dflydev\FigCookies\SetCookie;
 use Flarum\Foundation\Application;
 use Illuminate\Support\Arr;
@@ -43,6 +44,13 @@ class CookieFactory
      */
     protected $secure;
 
+    /**
+     * Same Site cookie value.
+     *
+     * @var string
+     */
+    protected $samesite;
+
     /**
      * @param Application $app
      */
@@ -56,6 +64,7 @@ public function __construct(Application $app)
         $this->path = $app->config('cookie.path', Arr::get($url, 'path') ?: '/');
         $this->domain = $app->config('cookie.domain');
         $this->secure = $app->config('cookie.secure', Arr::get($url, 'scheme') === 'https');
+        $this->samesite = $app->config('cookie.samesite', 'lax');
     }
 
     /**
@@ -85,6 +94,15 @@ public function make($name, $value = null, $maxAge = null)
             $cookie = $cookie->withDomain($this->domain);
         }
 
+        // Explicitly set SameSite value, use sensible default if no value provided
+        if ($this->samesite === 'strict') {
+            $cookie = $cookie->withSameSite(SameSite::strict());
+        } elseif ($this->samesite === 'none') {
+            $cookie = $cookie->withSameSite(SameSite::none());
+        } else {
+            $cookie = $cookie->withSameSite(SameSite::lax());
+        }
+
         return $cookie
             ->withPath($this->path)
             ->withSecure($this->secure)