-
-
Notifications
You must be signed in to change notification settings - Fork 9.7k
Closed
Description
Symfony version(s) affected: 4.2
Description
Starting or regenerating a session using NativeSessionStorage with option 'cookie_samesite
' = true, erases previously set cookies.
This issue affects PHP versions < 7.3
How to reproduce
use Symfony\Component\HttpFoundation\Session\Storage\NativeSessionStorage;
$storage = new NativeSessionStorage(['cookie_samesite' => true]);
// Tries to send a cookie
setcookie("TestCookie", "foo");
// This method (and also NativeSessionStorage::regenerate()) deletes the previous cookie
$storage->start();
$headers = headers_list();
print_r($headers);
// We expect 'Set-Cookie: TestCookie=foo' in the headers, but it's missing.
NOTE: To properly reproduce the problem, you must delete the PHPSESSID cookie in your browser, if exists
Possible Solution
When setting session cookie with header()
function, we can prevent replacing existing "Set-Cookie" headers using the second optional parameter for header() function: replace = false.
In NativeSessionStorage
class, inside start()
and regenerate()
methods, change this code:
header(sprintf('%s; SameSite=%s', $originalCookie, $this->emulateSameSite));
into this:
header(sprintf('%s; SameSite=%s', $originalCookie, $this->emulateSameSite), false);