[Security] Ability to set SameSite attribute for session and remember me cookie

[umpirsky]

Description
It would be useful if we could expose SameSite attribute for session and remember me cookie via yaml config.

Example

framework:
    session:
        name: NameOfTheCookie
        cookie_samesite: lax

security:
    firewalls:
        remember_me:
            name: NameOfTheCookie
            samesite: lax

Currently it's extremely painful to override it (unless I'm missing something?).

[umpirsky]

@javiereguiluz I'm interested into contributing this. Just need feedback to see if we are on the right track.

[javiereguiluz]

I think it would make sense to add this option, although I'd prefer if we use cookie_samesite as the name of the two options, instead of cookie_samesite and samesite.

But let's ask first to people with lots of experience in the Security component, such as @iltar and @chalasr. Thanks!

[stof]

now that we support samesite cookies in HttpFoundation, it indeed makes sense to support them here.

[umpirsky]

@javiereguiluz See https://symfony.com/doc/current/reference/configuration/security.html

remember_me:
                token_provider: name
                secret: "%secret%"
                name: NameOfTheCookie
                lifetime: 3600 # in seconds
                path: /foo
                domain: somedomain.foo
                secure: false
                httponly: true
                always_remember_me: false
                remember_me_parameter: _remember_me

cookie_ prefix there would lead to naming inconsistency. A bigger inconsistency then the one I proposed in the issue description.

[rpkamp]

What is the status here? I'd love to be able to use this and wouldn't mind helping out if help is needed.

[xabbuh]

This was implemented in #27976 and thus will be part of Symfony 4.2.

[rpkamp]

@xabbuh, that is only for "remember me", so SameSite has not been implemented for sessions yet?

[nicolas-grekas]

I think you're correct, since setting the samesite flag for session cookies is a new feature of PHP 7.3.
We should experiment with a way to backport the behavior to lower PHP versions. Up to give it a try?

[rpkamp]

As far as I can tell Symfony no longer relies on PHP to send cookies but adds headers itself, which allows it to use SameSite already. See #25348. Am I missing something?

I'd happily create a PR to make an option for SameSite for session cookies.

[rpkamp]

Ah I see what you mean now, even though Cookie now is now send manually using header instead of set_cookie, Symfony's main session handler, NativeSessionHandler doesn't use Cookie at all, but rather session_start.

That does it make more difficult indeed for PHP versions that don't support it (PHP < 7.3). One thing we could do is what's done here https://github.com/delight-im/PHP-Cookie, basically:

1. Call session_start
2. Call headers_list and find the header added in there by session_start
3. Take that header and add ; SameSite=<value> and store it
4. Store all other cookies found in the headers
5. Call header_remove('Set-Cookie') to remove all cookies from the headers
6. Call send_header with the cookie created in step 3
7. Call send_header with all cookies stored in step 4

This does however raise the question, what if we can't find the header in the headers in step 2? Should we raise an exception? If so, what kind?

I'm also not sure this is something that would belong in Symfony core. Maybe it would be better as a userland implementation, a simple class that hooks into the kernel.response event for example.

[nicolas-grekas]

We do things like that in AbstractSessionHandler, maybe that's the place to implement the support for samesite in sessions?

[rpkamp]

@nicolas-grekas PR created: #28168