Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow to set SameSite from system.yaml #3063

Merged
merged 4 commits into from
Nov 12, 2020
Merged

Allow to set SameSite from system.yaml #3063

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
296fb34
Update system.yaml
randoum Nov 11, 2020
d5c0597
Update SessionServiceProvider.php
randoum Nov 11, 2020
87a5045
Update Session.php
randoum Nov 11, 2020
09809d7
Update system.yaml
randoum Nov 11, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions system/blueprints/config/system.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1223,6 +1223,12 @@ form:
label: PLUGIN_ADMIN.SESSION_PATH
help: PLUGIN_ADMIN.SESSION_PATH_HELP

session.samesite:
type: text
size: small
label: PLUGIN_ADMIN.SESSION_SAMESITE
help: PLUGIN_ADMIN.SESSION_SAMESITE_HELP

session.split:
type: toggle
label: PLUGIN_ADMIN.SESSION_SPLIT
Expand Down
1 change: 1 addition & 0 deletions system/config/system.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,6 +161,7 @@ session:
uniqueness: path # Should sessions be `path` based or `security.salt` based
secure: false # Set session secure. If true, indicates that communication for this cookie must be over an encrypted transmission. Enable this only on sites that run exclusively on HTTPS
httponly: true # Set session HTTP only. If true, indicates that cookies should be used only over HTTP, and JavaScript modification is not allowed.
samesite: # Set session SameSite. See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
split: true # Sessions should be independent between site and plugins (such as admin)
path:

Expand Down
4 changes: 3 additions & 1 deletion system/src/Grav/Common/Service/SessionServiceProvider.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,7 @@ public function register(Container $container)
$cookie_httponly = (bool)$config->get('system.session.httponly', true);
$cookie_lifetime = (int)$config->get('system.session.timeout', 1800);
$cookie_path = $config->get('system.session.path');
$cookie_samesite = $config->get('system.session.samesite');
if (null === $cookie_path) {
$cookie_path = '/' . trim(Uri::filterPath($uri->rootUrl(false)), '/');
}
Expand Down Expand Up @@ -87,7 +88,8 @@ public function register(Container $container)
'cookie_path' => $cookie_path,
'cookie_domain' => $cookie_domain,
'cookie_secure' => $cookie_secure,
'cookie_httponly' => $cookie_httponly
'cookie_httponly' => $cookie_httponly,
'cookie_samesite' => $cookie_samesite
] + (array) $config->get('system.session.options');

$session = new Session($options);
Expand Down
32 changes: 22 additions & 10 deletions system/src/Grav/Framework/Session/Session.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,6 +135,7 @@ public function setOptions(array $options)
'use_strict_mode' => true,
'use_cookies' => true,
'use_only_cookies' => true,
'cookie_samesite' => true,
'referer_check' => true,
'cache_limiter' => true,
'cache_expire' => true,
Expand Down Expand Up @@ -211,14 +212,19 @@ public function start($readonly = false)
if ($sessionExists) {
$params = session_get_cookie_params();

$cookie_options = array (
'expires' => time() + $params['lifetime'],
'path' => $params['path'],
'domain' => $params['domain'],
'secure' => $params['secure'],
'httponly' => $params['httponly'],
'samesite' => $params['samesite']
);

setcookie(
$sessionName,
session_id(),
time() + $params['lifetime'],
$params['path'],
$params['domain'],
$params['secure'],
$params['httponly']
$cookie_options
);
}

Expand All @@ -231,14 +237,20 @@ public function start($readonly = false)
public function invalidate()
{
$params = session_get_cookie_params();

$cookie_options = array (
'expires' => time() - 42000,
'path' => $params['path'],
'domain' => $params['domain'],
'secure' => $params['secure'],
'httponly' => $params['httponly'],
'samesite' => $params['samesite']
);

setcookie(
session_name(),
'',
time() - 42000,
$params['path'],
$params['domain'],
$params['secure'],
$params['httponly']
$cookie_options
);

if ($this->isSessionStarted()) {
Expand Down