From b37011b416c936ac8a55928c2400c702986a7910 Mon Sep 17 00:00:00 2001
From: maxpozdeev <maxpozdeev@gmail.com>
Date: Thu, 3 Nov 2022 00:20:32 +0300
Subject: [PATCH] add samesite=lax and httpOnly to anti-csrf cookies

---
 src/init.php  | 20 ++++++++++++++------
 src/setup.php | 11 ++++++++++-
 2 files changed, 24 insertions(+), 7 deletions(-)

diff --git a/src/init.php b/src/init.php
index 2000663..de3a069 100644
--- a/src/init.php
+++ b/src/init.php
@@ -191,7 +191,16 @@ function update_token(): string
         $_SESSION['token'] = $token;
     }
     else {
-        setcookie('mtt-token', $token, 0, url_dir(get_unsafe_mttinfo('mtt_url')) );
+        if (PHP_VERSION_ID < 70300) {
+            setcookie('mtt-token', $token, 0, url_dir(get_unsafe_mttinfo('mtt_url')). '; samesite=lax', '', false, true );
+        }
+        else {
+            setcookie('mtt-token', $token, [
+                'path' => url_dir(get_unsafe_mttinfo('mtt_url')),
+                'httponly' => true,
+                'samesite' => 'lax'
+            ]);
+        }
         $_COOKIE['mtt-token'] = $token;
     }
     return $token;
@@ -214,18 +223,17 @@ function setup_and_start_session()
 
     $lifetime = 5184000; # 60 days session cookie lifetime
     $path = url_dir(Config::get('url')=='' ? getRequestUri() : Config::getUrl('url'));
-    $samesite = 'lax';
 
     if (PHP_VERSION_ID < 70300) {
         # this is a known samesite flag workaround, was fixed in 7.3
-        session_set_cookie_params($lifetime, $path. '; samesite='.$samesite, null, null, true);
+        session_set_cookie_params($lifetime, $path. '; samesite=lax', null, null, true);
     } else {
-        session_set_cookie_params(Array(
+        session_set_cookie_params([
             'lifetime' => $lifetime,
             'path' => $path,
             'httponly' => true,
-            'samesite' => $samesite
-        ));
+            'samesite' => 'lax'
+        ]);
     }
     session_name('mtt-session');
     session_start();
diff --git a/src/setup.php b/src/setup.php
index bf3c9d6..5e9b306 100644
--- a/src/setup.php
+++ b/src/setup.php
@@ -205,7 +205,16 @@ function stoken()
 function update_stoken()
 {
     $token = generateUUID();
-    setcookie('mtt-s-token', $token, 0, url_dir(getRequestUri()) ) ;
+    if (PHP_VERSION_ID < 70300) {
+        setcookie('mtt-s-token', $token, 0, url_dir(getRequestUri()). '; samesite=lax', '', false, true ) ;
+    }
+    else {
+        setcookie('mtt-s-token', $token, [
+            'path' => url_dir(getRequestUri()),
+            'httponly' => true,
+            'samesite' => 'lax'
+        ]);
+    }
     $_COOKIE['mtt-s-token'] = $token;
     return $token;
 }