feature #27976 [Security] Remember me: allow to set the samesite cookie flag (dunglas)
This PR was merged into the 4.2-dev branch.
Discussion
----------
[Security] Remember me: allow to set the samesite cookie flag
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | no
| New feature? | yes <!-- don't forget to update src/**/CHANGELOG.md files -->
| BC breaks? | no <!-- see https://symfony.com/bc -->
| Deprecations? |no <!-- don't forget to update UPGRADE-*.md and src/**/CHANGELOG.md files -->
| Tests pass? | no
| Fixed tickets | no
| License | MIT
| Doc PR | symfony/symfony-docs#10077
This PR allows to set the [`samesite`](https://www.owasp.org/index.php/SameSite) cookie flag for remember me token cookies.
Commits
-------
337e8ef044
[Security] Remember me: allow to set the samesite cookie flag
This commit is contained in:
commit
9dbde41b16
@ -25,6 +25,7 @@ class RememberMeFactory implements SecurityFactoryInterface
|
||||
'domain' => null,
|
||||
'secure' => false,
|
||||
'httponly' => true,
|
||||
'samesite' => null,
|
||||
'always_remember_me' => false,
|
||||
'remember_me_parameter' => '_remember_me',
|
||||
);
|
||||
|
@ -271,7 +271,7 @@ abstract class AbstractRememberMeServices implements RememberMeServicesInterface
|
||||
$this->logger->debug('Clearing remember-me cookie.', array('name' => $this->options['name']));
|
||||
}
|
||||
|
||||
$request->attributes->set(self::COOKIE_ATTR_NAME, new Cookie($this->options['name'], null, 1, $this->options['path'], $this->options['domain'], $this->options['secure'], $this->options['httponly']));
|
||||
$request->attributes->set(self::COOKIE_ATTR_NAME, new Cookie($this->options['name'], null, 1, $this->options['path'], $this->options['domain'], $this->options['secure'], $this->options['httponly'], false, $this->options['samesite'] ?? null));
|
||||
}
|
||||
|
||||
/**
|
||||
|
@ -84,7 +84,9 @@ class PersistentTokenBasedRememberMeServices extends AbstractRememberMeServices
|
||||
$this->options['path'],
|
||||
$this->options['domain'],
|
||||
$this->options['secure'],
|
||||
$this->options['httponly']
|
||||
$this->options['httponly'],
|
||||
false,
|
||||
$this->options['samesite'] ?? null
|
||||
)
|
||||
);
|
||||
|
||||
@ -117,7 +119,9 @@ class PersistentTokenBasedRememberMeServices extends AbstractRememberMeServices
|
||||
$this->options['path'],
|
||||
$this->options['domain'],
|
||||
$this->options['secure'],
|
||||
$this->options['httponly']
|
||||
$this->options['httponly'],
|
||||
false,
|
||||
$this->options['samesite'] ?? null
|
||||
)
|
||||
);
|
||||
}
|
||||
|
@ -81,7 +81,9 @@ class TokenBasedRememberMeServices extends AbstractRememberMeServices
|
||||
$this->options['path'],
|
||||
$this->options['domain'],
|
||||
$this->options['secure'],
|
||||
$this->options['httponly']
|
||||
$this->options['httponly'],
|
||||
false,
|
||||
$this->options['samesite'] ?? null
|
||||
)
|
||||
);
|
||||
}
|
||||
|
@ -12,6 +12,7 @@
|
||||
namespace Symfony\Component\Security\Http\Tests\RememberMe;
|
||||
|
||||
use PHPUnit\Framework\TestCase;
|
||||
use Symfony\Component\HttpFoundation\Cookie;
|
||||
use Symfony\Component\Security\Http\RememberMe\RememberMeServicesInterface;
|
||||
use Symfony\Component\Security\Core\Exception\UsernameNotFoundException;
|
||||
use Symfony\Component\Security\Core\Authentication\RememberMe\PersistentToken;
|
||||
@ -268,7 +269,7 @@ class PersistentTokenBasedRememberMeServicesTest extends TestCase
|
||||
|
||||
public function testLoginSuccessSetsCookieWhenLoggedInWithNonRememberMeTokenInterfaceImplementation()
|
||||
{
|
||||
$service = $this->getService(null, array('name' => 'foo', 'domain' => 'myfoodomain.foo', 'path' => '/foo/path', 'secure' => true, 'httponly' => true, 'lifetime' => 3600, 'always_remember_me' => true));
|
||||
$service = $this->getService(null, array('name' => 'foo', 'domain' => 'myfoodomain.foo', 'path' => '/foo/path', 'secure' => true, 'httponly' => true, 'samesite' => Cookie::SAMESITE_STRICT, 'lifetime' => 3600, 'always_remember_me' => true));
|
||||
$request = new Request();
|
||||
$response = new Response();
|
||||
|
||||
@ -305,6 +306,7 @@ class PersistentTokenBasedRememberMeServicesTest extends TestCase
|
||||
$this->assertTrue($cookie->getExpiresTime() > time() + 3590 && $cookie->getExpiresTime() < time() + 3610);
|
||||
$this->assertEquals('myfoodomain.foo', $cookie->getDomain());
|
||||
$this->assertEquals('/foo/path', $cookie->getPath());
|
||||
$this->assertSame(Cookie::SAMESITE_STRICT, $cookie->getSameSite());
|
||||
}
|
||||
|
||||
protected function encodeCookie(array $parts)
|
||||
|
@ -12,6 +12,7 @@
|
||||
namespace Symfony\Component\Security\Http\Tests\RememberMe;
|
||||
|
||||
use PHPUnit\Framework\TestCase;
|
||||
use Symfony\Component\HttpFoundation\Cookie;
|
||||
use Symfony\Component\Security\Http\RememberMe\RememberMeServicesInterface;
|
||||
use Symfony\Component\Security\Core\Exception\UsernameNotFoundException;
|
||||
use Symfony\Component\HttpFoundation\Request;
|
||||
@ -205,7 +206,7 @@ class TokenBasedRememberMeServicesTest extends TestCase
|
||||
|
||||
public function testLoginSuccess()
|
||||
{
|
||||
$service = $this->getService(null, array('name' => 'foo', 'domain' => 'myfoodomain.foo', 'path' => '/foo/path', 'secure' => true, 'httponly' => true, 'lifetime' => 3600, 'always_remember_me' => true));
|
||||
$service = $this->getService(null, array('name' => 'foo', 'domain' => 'myfoodomain.foo', 'path' => '/foo/path', 'secure' => true, 'httponly' => true, 'samesite' => Cookie::SAMESITE_STRICT, 'lifetime' => 3600, 'always_remember_me' => true));
|
||||
$request = new Request();
|
||||
$response = new Response();
|
||||
|
||||
@ -240,6 +241,7 @@ class TokenBasedRememberMeServicesTest extends TestCase
|
||||
$this->assertTrue($cookie->getExpiresTime() > time() + 3590 && $cookie->getExpiresTime() < time() + 3610);
|
||||
$this->assertEquals('myfoodomain.foo', $cookie->getDomain());
|
||||
$this->assertEquals('/foo/path', $cookie->getPath());
|
||||
$this->assertSame(Cookie::SAMESITE_STRICT, $cookie->getSameSite());
|
||||
}
|
||||
|
||||
protected function getCookie($class, $username, $expires, $password)
|
||||
|
Reference in New Issue
Block a user