Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit ce5fef4

Browse files
dunglasnicolas-grekas
dunglas
authored and
nicolas-grekas
committed
[Security] Remember me: allow to set the samesite cookie flag
1 parent 0e2d5e9 commit ce5fef4

File tree

6 files changed

+17
-6
lines changed

6 files changed

+17
-6
lines changed

‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/Security/Factory/RememberMeFactory.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ class RememberMeFactory implements SecurityFactoryInterface
2525
'domain' => null,
2626
'secure' => false,
2727
'httponly' => true,
28+
'samesite' => null,
2829
'always_remember_me' => false,
2930
'remember_me_parameter' => '_remember_me',
3031
];

‎src/Symfony/Component/Security/Http/RememberMe/AbstractRememberMeServices.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -281,7 +281,7 @@ protected function cancelCookie(Request $request)
281281
$this->logger->debug('Clearing remember-me cookie.', ['name' => $this->options['name']]);
282282
}
283283

284-
$request->attributes->set(self::COOKIE_ATTR_NAME, new Cookie($this->options['name'], null, 1, $this->options['path'], $this->options['domain'], $this->options['secure'], $this->options['httponly']));
284+
$request->attributes->set(self::COOKIE_ATTR_NAME, new Cookie($this->options['name'], null, 1, $this->options['path'], $this->options['domain'], $this->options['secure'], $this->options['httponly'], false, $this->options['samesite'] ?? null));
285285
}
286286

287287
/**

‎src/Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices.php

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,9 @@ protected function processAutoLoginCookie(array $cookieParts, Request $request)
8484
$this->options['path'],
8585
$this->options['domain'],
8686
$this->options['secure'],
87-
$this->options['httponly']
87+
$this->options['httponly'],
88+
false,
89+
$this->options['samesite'] ?? null
8890
)
8991
);
9092

@@ -117,7 +119,9 @@ protected function onLoginSuccess(Request $request, Response $response, TokenInt
117119
$this->options['path'],
118120
$this->options['domain'],
119121
$this->options['secure'],
120-
$this->options['httponly']
122+
$this->options['httponly'],
123+
false,
124+
$this->options['samesite'] ?? null
121125
)
122126
);
123127
}

‎src/Symfony/Component/Security/Http/RememberMe/TokenBasedRememberMeServices.php

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,9 @@ protected function onLoginSuccess(Request $request, Response $response, TokenInt
8181
$this->options['path'],
8282
$this->options['domain'],
8383
$this->options['secure'],
84-
$this->options['httponly']
84+
$this->options['httponly'],
85+
false,
86+
$this->options['samesite'] ?? null
8587
)
8688
);
8789
}

‎src/Symfony/Component/Security/Http/Tests/RememberMe/PersistentTokenBasedRememberMeServicesTest.php

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
namespace Symfony\Component\Security\Http\Tests\RememberMe;
1313

1414
use PHPUnit\Framework\TestCase;
15+
use Symfony\Component\HttpFoundation\Cookie;
1516
use Symfony\Component\HttpFoundation\Request;
1617
use Symfony\Component\HttpFoundation\Response;
1718
use Symfony\Component\HttpFoundation\ResponseHeaderBag;
@@ -268,7 +269,7 @@ public function testLoginFail()
268269

269270
public function testLoginSuccessSetsCookieWhenLoggedInWithNonRememberMeTokenInterfaceImplementation()
270271
{
271-
$service = $this->getService(null, ['name' => 'foo', 'domain' => 'myfoodomain.foo', 'path' => '/foo/path', 'secure' => true, 'httponly' => true, 'lifetime' => 3600, 'always_remember_me' => true]);
272+
$service = $this->getService(null, ['name' => 'foo', 'domain' => 'myfoodomain.foo', 'path' => '/foo/path', 'secure' => true, 'httponly' => true, 'samesite' => Cookie::SAMESITE_STRICT, 'lifetime' => 3600, 'always_remember_me' => true]);
272273
$request = new Request();
273274
$response = new Response();
274275

@@ -305,6 +306,7 @@ public function testLoginSuccessSetsCookieWhenLoggedInWithNonRememberMeTokenInte
305306
$this->assertTrue($cookie->getExpiresTime() > time() + 3590 && $cookie->getExpiresTime() < time() + 3610);
306307
$this->assertEquals('myfoodomain.foo', $cookie->getDomain());
307308
$this->assertEquals('/foo/path', $cookie->getPath());
309+
$this->assertSame(Cookie::SAMESITE_STRICT, $cookie->getSameSite());
308310
}
309311

310312
protected function encodeCookie(array $parts)

‎src/Symfony/Component/Security/Http/Tests/RememberMe/TokenBasedRememberMeServicesTest.php

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
namespace Symfony\Component\Security\Http\Tests\RememberMe;
1313

1414
use PHPUnit\Framework\TestCase;
15+
use Symfony\Component\HttpFoundation\Cookie;
1516
use Symfony\Component\HttpFoundation\Request;
1617
use Symfony\Component\HttpFoundation\Response;
1718
use Symfony\Component\HttpFoundation\ResponseHeaderBag;
@@ -205,7 +206,7 @@ public function testLoginSuccessIgnoresTokensWhichDoNotContainAnUserInterfaceImp
205206

206207
public function testLoginSuccess()
207208
{
208-
$service = $this->getService(null, ['name' => 'foo', 'domain' => 'myfoodomain.foo', 'path' => '/foo/path', 'secure' => true, 'httponly' => true, 'lifetime' => 3600, 'always_remember_me' => true]);
209+
$service = $this->getService(null, ['name' => 'foo', 'domain' => 'myfoodomain.foo', 'path' => '/foo/path', 'secure' => true, 'httponly' => true, 'samesite' => Cookie::SAMESITE_STRICT, 'lifetime' => 3600, 'always_remember_me' => true]);
209210
$request = new Request();
210211
$response = new Response();
211212

@@ -240,6 +241,7 @@ public function testLoginSuccess()
240241
$this->assertTrue($cookie->getExpiresTime() > time() + 3590 && $cookie->getExpiresTime() < time() + 3610);
241242
$this->assertEquals('myfoodomain.foo', $cookie->getDomain());
242243
$this->assertEquals('/foo/path', $cookie->getPath());
244+
$this->assertSame(Cookie::SAMESITE_STRICT, $cookie->getSameSite());
243245
}
244246

245247
protected function getCookie($class, $username, $expires, $password)

0 commit comments

Comments
 (0)