Bug #76906 [Opn->Sus]: setcookie() doesn't handle "samesite" attribute while the RFC says it should

Edit report at https://bugs.php.net/bug.php?id=76906&edit=1 ID: 76906 Updated by: requinix@php.net Reported by: nicolas dot grekas+php at gmail dot com Summary: setcookie() doesn't handle "samesite" attribute while the RFC says it should -Status: Open +Status: Suspended Type: Bug Package: Scripting Engine problem PHP Version: 7.3.0RC1 Block user comment: N Private report: N New Comment: The expires argument was moved into the array, making the array argument be the third position. setcookie('b', 'a', array()); While there was some discussion about this happening, I'm not convinced there was a conclusion reached. Want to bring it up on the internals list? Previous Comments: ------------------------------------------------------------------------ [2018-09-19 20:58:26] nicolas dot grekas+php at gmail dot com Description: ------------ Per https://wiki.php.net/rfc/same-site-cookie setcookie should accept a 4th "array $options" argument. But this doesn't work. I didn't check the other function mentioned in the RFC so they might have the same issue. Test script: --------------- <?php setcookie('b', 'a', 0, array()); setcookie('b', 'a', 0, '/', '', false, false, 'lax'); See https://3v4l.org/52qe6 Expected result: ---------------- Warning: setcookie() expects at most 7 parameters, 8 given in /in/52qe6 on line 4 Actual result: -------------- Warning: setcookie() expects parameter 4 to be string, array given in /in/52qe6 on line 3 Warning: setcookie() expects at most 7 parameters, 8 given in /in/52qe6 on line 4 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=76906&edit=1