Skip to content

[HttpFoundation] NativeSessionStorage erases Set-Cookie headers #29675

@eiannone

Description

@eiannone

Symfony version(s) affected: 4.2

Description
Starting or regenerating a session using NativeSessionStorage with option 'cookie_samesite' = true, erases previously set cookies.
This issue affects PHP versions < 7.3

How to reproduce

use Symfony\Component\HttpFoundation\Session\Storage\NativeSessionStorage;

$storage = new NativeSessionStorage(['cookie_samesite' => true]);

// Tries to send a cookie
setcookie("TestCookie", "foo");

// This method (and also NativeSessionStorage::regenerate()) deletes the previous cookie
$storage->start(); 

$headers = headers_list();
print_r($headers); 
// We expect 'Set-Cookie: TestCookie=foo' in the headers, but it's missing.

NOTE: To properly reproduce the problem, you must delete the PHPSESSID cookie in your browser, if exists

Possible Solution
When setting session cookie with header() function, we can prevent replacing existing "Set-Cookie" headers using the second optional parameter for header() function: replace = false.

In NativeSessionStorage class, inside start() and regenerate() methods, change this code:

header(sprintf('%s; SameSite=%s', $originalCookie, $this->emulateSameSite));

into this:

header(sprintf('%s; SameSite=%s', $originalCookie, $this->emulateSameSite), false);

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions