Skip to content
This repository was archived by the owner on Nov 18, 2025. It is now read-only.

Commit 79d07e2

Browse files
otengkwameotengkwame
committed
✨ improve cookie and session functionalities with samesite option
1 parent 2421319 commit 79d07e2

File tree

5 files changed

+101
-76
lines changed

5 files changed

+101
-76
lines changed

‎framework/core/Input.php‎

Lines changed: 37 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -345,21 +345,22 @@ public function input_stream($index = NULL, $xss_clean = NULL)
345345

346346
/**
347347
* Set cookie
348-
*
349-
* Accepts an arbitrary number of parameters (up to 7) or an associative
350-
* array in the first parameter containing all the values.
351-
*
352-
* @param string|mixed[] $name Cookie name or an array containing parameters
353-
* @param string $value Cookie value
354-
* @param int $expire Cookie expiration time in seconds
355-
* @param string $domain Cookie domain (e.g.: '.yourdomain.com')
356-
* @param string $path Cookie path (default: '/')
357-
* @param string $prefix Cookie name prefix
358-
* @param bool $secure Whether to only transfer cookies via SSL
359-
* @param bool $httponly Whether to only makes the cookie accessible via HTTP (no javascript)
360-
* @return void
361-
*/
362-
public function set_cookie($name, $value = '', $expire = '', $domain = '', $path = '/', $prefix = '', $secure = NULL, $httponly = NULL)
348+
*
349+
* Accepts an arbitrary number of parameters (up to 7) or an associative
350+
* array in the first parameter containing all the values.
351+
*
352+
* @param string|mixed[] $name Cookie name or an array containing parameters
353+
* @param string $value Cookie value
354+
* @param int $expire Cookie expiration time in seconds
355+
* @param string $domain Cookie domain (e.g.: '.yourdomain.com')
356+
* @param string $path Cookie path (default: '/')
357+
* @param string $prefix Cookie name prefix
358+
* @param bool $secure Whether to only transfer cookies via SSL
359+
* @param bool $httponly Whether to only makes the cookie accessible via HTTP (no javascript)
360+
* @param string|NULL $samesite The SameSite cookie setting (Possible values: 'Lax', 'Strict', 'None', NULL, default: NULL)
361+
* @return void
362+
*/
363+
public function set_cookie($name, $value = '', $expire = 0, $domain = '', $path = '/', $prefix = '', $secure = NULL, $httponly = NULL, $samesite = NULL)
363364
{
364365
if (is_array($name))
365366
{
@@ -395,17 +396,34 @@ public function set_cookie($name, $value = '', $expire = '', $domain = '', $path
395396
$httponly = ($httponly === NULL && config_item('cookie_httponly') !== NULL)
396397
? (bool) config_item('cookie_httponly')
397398
: (bool) $httponly;
399+
400+
// Handle cookie 'samesite' attribute
401+
$samesite = ($samesite === NULL && config_item('cookie_samesite') !== NULL)
402+
? config_item('cookie_samesite')
403+
: 'None';
398404

399-
if ( ! is_numeric($expire))
405+
if ( ! is_numeric($expire) OR $expire < 0)
400406
{
401-
$expire = time() - 86500;
407+
$expire = 1;
402408
}
403409
else
404410
{
405411
$expire = ($expire > 0) ? time() + $expire : 0;
406412
}
407-
408-
setcookie($prefix.$name, $value, $expire, $path, $domain, $secure, $httponly);
413+
414+
// using setcookie with array option to add cookie 'samesite' attribute
415+
setcookie(
416+
$prefix.$name,
417+
$value,
418+
array(
419+
'expires' => $expire,
420+
'path' => $path,
421+
'domain' => $domain,
422+
'secure' => $secure,
423+
'httponly' => $httponly,
424+
'samesite' => $samesite // add samesite attribute
425+
)
426+
);
409427
}
410428

411429
// --------------------------------------------------------------------

‎framework/core/Security.php‎

Lines changed: 13 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -272,35 +272,19 @@ public function csrf_set_cookie()
272272
return FALSE;
273273
}
274274

275-
if (is_php('7.3'))
276-
{
277-
setcookie(
278-
$this->_csrf_cookie_name,
279-
$this->_csrf_hash,
280-
array(
281-
'expires' => $expire,
282-
'path' => config_item('cookie_path'),
283-
'domain' => config_item('cookie_domain'),
284-
'secure' => $secure_cookie,
285-
'httponly' => config_item('cookie_httponly'),
286-
'samesite' => 'Strict'
287-
)
288-
);
289-
}
290-
else
291-
{
292-
$domain = trim(config_item('cookie_domain'));
293-
header('Set-Cookie: '.$this->_csrf_cookie_name.'='.$this->_csrf_hash
294-
.'; Expires='.gmdate('D, d-M-Y H:i:s T', $expire)
295-
.'; Max-Age='.$this->_csrf_expire
296-
.'; Path='.rawurlencode(config_item('cookie_path'))
297-
.($domain === '' ? '' : '; Domain='.$domain)
298-
.($secure_cookie ? '; Secure' : '')
299-
.(config_item('cookie_httponly') ? '; HttpOnly' : '')
300-
.'; SameSite=Strict'
301-
);
302-
}
303-
275+
// using setcookie with array option to add cookie 'samesite' attribute
276+
setcookie(
277+
$this->_csrf_cookie_name,
278+
$this->_csrf_hash,
279+
array(
280+
'expires' => $expire,
281+
'path' => config_item('cookie_path'),
282+
'domain' => config_item('cookie_domain'),
283+
'secure' => $secure_cookie,
284+
'httponly' => config_item('cookie_httponly'),
285+
'samesite' => config_item('cookie_samesite') // add samesite attribute
286+
)
287+
);
304288
log_message('info', 'CSRF cookie sent');
305289

306290
return $this;

‎framework/helpers/cookie_helper.php‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -57,20 +57,21 @@
5757
* Accepts seven parameters, or you can submit an associative
5858
* array in the first parameter containing all the values.
5959
*
60-
* @param mixed
61-
* @param string the value of the cookie
62-
* @param string the number of seconds until expiration
63-
* @param string the cookie domain. Usually: .yourdomain.com
64-
* @param string the cookie path
65-
* @param string the cookie prefix
66-
* @param bool true makes the cookie secure
67-
* @param bool true makes the cookie accessible via http(s) only (no javascript)
60+
* @param string|mixed[] the cookie name or an array containing parameters
61+
* @param string $value the value of the cookie
62+
* @param int $expire the number of seconds until expiration
63+
* @param string $domain the cookie domain. Usually: .yourdomain.com
64+
* @param string $path the cookie path
65+
* @param string $prefix the cookie prefix
66+
* @param bool $secure true makes the cookie secure
67+
* @param bool $httponly true makes the cookie accessible via http(s) only (no javascript)
68+
* @param string|NULL $samesite the samesite cookie setting (Possible values: 'Lax', 'Strict', 'None', NULL, default: NULL)
6869
* @return void
6970
*/
70-
function set_cookie($name, $value = '', $expire = '', $domain = '', $path = '/', $prefix = '', $secure = NULL, $httponly = NULL)
71+
function set_cookie($name, $value = '', $expire = 0, $domain = '', $path = '/', $prefix = '', $secure = NULL, $httponly = NULL, $samesite = NULL)
7172
{
7273
// Set the config file options
73-
get_instance()->input->set_cookie($name, $value, $expire, $domain, $path, $prefix, $secure, $httponly);
74+
get_instance()->input->set_cookie($name, $value, $expire, $domain, $path, $prefix, $secure, $httponly, $samesite);
7475
}
7576
}
7677

@@ -85,9 +86,8 @@ function set_cookie($name, $value = '', $expire = '', $domain = '', $path = '/',
8586
* @param bool
8687
* @return mixed
8788
*/
88-
function get_cookie($index, $xss_clean = NULL)
89+
function get_cookie($index, $xss_clean = FALSE)
8990
{
90-
is_bool($xss_clean) OR $xss_clean = (config_item('global_xss_filtering') === TRUE);
9191
$prefix = isset($_COOKIE[$index]) ? '' : config_item('cookie_prefix');
9292
return get_instance()->input->cookie($prefix.$index, $xss_clean);
9393
}

‎framework/libraries/Session/Session.php‎

Lines changed: 21 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -160,14 +160,18 @@ public function __construct(array $params = array())
160160
// unless it is being currently created or regenerated
161161
elseif (isset($_COOKIE[$this->_config['cookie_name']]) && $_COOKIE[$this->_config['cookie_name']] === session_id())
162162
{
163+
// using setcookie with array option to add cookie 'samesite' attribute
163164
setcookie(
164165
$this->_config['cookie_name'],
165-
session_id(),
166-
(empty($this->_config['cookie_lifetime']) ? 0 : time() + $this->_config['cookie_lifetime']),
167-
$this->_config['cookie_path'],
168-
$this->_config['cookie_domain'],
169-
$this->_config['cookie_secure'],
170-
TRUE
166+
session_id(),
167+
array(
168+
'expires' => (empty($this->_config['cookie_lifetime']) ? 0 : time() + $this->_config['cookie_lifetime']),
169+
'path' => $this->_config['cookie_path'],
170+
'domain' => $this->_config['cookie_domain'],
171+
'secure' => $this->_config['cookie_secure'],
172+
'httponly' => TRUE,
173+
'samesite' => config_item('cookie_samesite') // add samesite attribute
174+
)
171175
);
172176
}
173177

@@ -286,12 +290,18 @@ protected function _configure(&$params)
286290
isset($params['cookie_domain']) OR $params['cookie_domain'] = config_item('cookie_domain');
287291
isset($params['cookie_secure']) OR $params['cookie_secure'] = (bool) config_item('cookie_secure');
288292

293+
// additional for cookie 'samesite' attribute
294+
isset($params['cookie_samesite']) OR $params['cookie_samesite'] = config_item('cookie_samesite');
295+
289296
session_set_cookie_params(
290-
$params['cookie_lifetime'],
291-
$params['cookie_path'],
292-
$params['cookie_domain'],
293-
$params['cookie_secure'],
294-
TRUE // HttpOnly; Yes, this is intentional and not configurable for security reasons
297+
array(
298+
'lifetime' => $params['cookie_lifetime'],
299+
'path' => $params['cookie_path'],
300+
'domain' => $params['cookie_domain'],
301+
'secure' => $params['cookie_secure'],
302+
'httponly' => TRUE, // HttpOnly; Yes, this is intentional and not configurable for security reasons
303+
'samesite' => $params['cookie_samesite'] // The value of the samesite element should be either None, Lax or Strict
304+
)
295305
);
296306

297307
if (empty($expiration))

‎framework/libraries/Session/Session_driver.php‎

Lines changed: 18 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -139,14 +139,27 @@ public function php5_validate_id()
139139
*/
140140
protected function _cookie_destroy()
141141
{
142+
// return setcookie(
143+
// $this->_config['cookie_name'],
144+
// NULL,
145+
// 1,
146+
// $this->_config['cookie_path'],
147+
// $this->_config['cookie_domain'],
148+
// $this->_config['cookie_secure'],
149+
// TRUE
150+
// );
151+
// using setcookie with array option to add cookie 'samesite' attribute
142152
return setcookie(
143153
$this->_config['cookie_name'],
144154
NULL,
145-
1,
146-
$this->_config['cookie_path'],
147-
$this->_config['cookie_domain'],
148-
$this->_config['cookie_secure'],
149-
TRUE
155+
array(
156+
'expires' => 1,
157+
'path' => $this->_config['cookie_path'],
158+
'domain' => $this->_config['cookie_domain'],
159+
'secure' => $this->_config['cookie_secure'],
160+
'httponly' => TRUE,
161+
'samesite' => $this->_config['cookie_samesite'] // add samesite attribute
162+
)
150163
);
151164
}
152165

0 commit comments

Comments
 (0)