Re: [RFC] samesite cookie implementation

Hi Andrey, Thanks for your feedback. If we are going to wait for http_cookie_set, then my guess will be that it will take a while before we see samesite cookie implemented. While I totally agree there is need for a new function with a better API, I fail to see why that would mean we cannot have a samesite argument in the set(raw)cookie functions now. The RFC is in line with the design of these functions. With regard to browsers not implementing it, let me quote the currrent documentation on the httponly argument. "It has been suggested that this setting can effectively help to reduce identity theft through XSS attacks (although it is not supported by all browsers), but that claim is often disputed." Basically it says that it is not supported by all browsers, but provides help reducing XSS attacks. I don't see the difference with samesite. Best, Frederik On 18-07-17 12:37, Andrey Andreev wrote:

Hi Frederik, On Tue, Jul 18, 2017 at 12:11 AM, Frederik Bosch | Genkgo <f.bosch@genkgo.nl> wrote:

LS, Today I finished writing the RFC for implementing same site cookies in PHP, https://wiki.php.net/rfc/same-site-cookie. I am happy to receive your remarks on the proposal, and improve when necessary. For those (only) interested in code, have a look at PR # 2613: https://github.com/php/php-src/pull/2613. For the record, I am just a messenger in this regard. Someone uploaded a patch for this feature in bug #72230: https://bugs.php.net/bug.php?id=72230. I just took the opportunity to create a PR and the corresponding RFC. Credits for the code go to xistence at 0x90 dot nl. Hopefully, the samesite cookie flag will become a feature of the PHP language through this RFC!

Unfortunately, all of the cons you've explained in the RFC are very valid concerns. I'd rather first see what happens with http_cookie_set() that's being talked about in another thread currently (I suspect inspired by this). Cheers, Andrey.

-- Frederik Bosch Partner Genkgo logo Mail: f.bosch@genkgo.nl <mailto:f.bosch@genkgo.nl> Web: support.genkgo.com <https://support.genkgo.com> Entrada 123 Amsterdam +31 208 943 931 Genkgo B.V. staat geregistreerd bij de Kamer van Koophandel onder nummer 56501153