prehistoric-systems/mytinytodo
1
0
Fork 0
mirror of https://github.com/maxpozdeev/mytinytodo.git synced 2026-03-11 08:55:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

add samesite=lax and httpOnly to anti-csrf cookies

Browse source
This commit is contained in:
maxpozdeev 2022-11-03 00:20:32 +03:00
parent 03a7765f9f
commit b37011b416
2 changed files with 24 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
src/init.php
View file

@ -191,7 +191,16 @@ function update_token(): string
$_SESSION['token'] = $token;
}
else {
setcookie('mtt-token', $token, 0, url_dir(get_unsafe_mttinfo('mtt_url')) );
if (PHP_VERSION_ID < 70300) {
setcookie('mtt-token', $token, 0, url_dir(get_unsafe_mttinfo('mtt_url')). '; samesite=lax', '', false, true );
}
else {
setcookie('mtt-token', $token, [
'path' => url_dir(get_unsafe_mttinfo('mtt_url')),
'httponly' => true,
'samesite' => 'lax'
]);
}
$_COOKIE['mtt-token'] = $token;
}
return $token;
@ -214,18 +223,17 @@ function setup_and_start_session()
$lifetime = 5184000; # 60 days session cookie lifetime
$path = url_dir(Config::get('url')=='' ? getRequestUri() : Config::getUrl('url'));
$samesite = 'lax';
if (PHP_VERSION_ID < 70300) {
# this is a known samesite flag workaround, was fixed in 7.3
session_set_cookie_params($lifetime, $path. '; samesite='.$samesite, null, null, true);
session_set_cookie_params($lifetime, $path. '; samesite=lax', null, null, true);
} else {
session_set_cookie_params(Array(
session_set_cookie_params([
'lifetime' => $lifetime,
'path' => $path,
'httponly' => true,
'samesite' => $samesite
));
'samesite' => 'lax'
]);
}
session_name('mtt-session');
session_start();

11
src/setup.php
View file

@ -205,7 +205,16 @@ function stoken()
function update_stoken()
{
$token = generateUUID();
setcookie('mtt-s-token', $token, 0, url_dir(getRequestUri()) ) ;
if (PHP_VERSION_ID < 70300) {
setcookie('mtt-s-token', $token, 0, url_dir(getRequestUri()). '; samesite=lax', '', false, true ) ;
}
else {
setcookie('mtt-s-token', $token, [
'path' => url_dir(getRequestUri()),
'httponly' => true,
'samesite' => 'lax'
]);
}
$_COOKIE['mtt-s-token'] = $token;
return $token;
}