From d9405cc194bac96635dac896bbb65404bb03873d Mon Sep 17 00:00:00 2001 From: David Grudl Date: Sat, 9 Mar 2019 03:20:35 +0100 Subject: [PATCH] HttpExtension: option 'sameSiteProtection' does not change session cookie flag 'samesite' --- src/Bridges/HttpDI/HttpExtension.php | 5 ----- tests/Http.DI/HttpExtension.sameSiteProtection.phpt | 2 +- 2 files changed, 1 insertion(+), 6 deletions(-) diff --git a/src/Bridges/HttpDI/HttpExtension.php b/src/Bridges/HttpDI/HttpExtension.php index 675da2e8..c3290dc2 100644 --- a/src/Bridges/HttpDI/HttpExtension.php +++ b/src/Bridges/HttpDI/HttpExtension.php @@ -82,11 +82,6 @@ public function beforeCompile() $builder->getDefinitionByType(Nette\Http\Session::class) ->addSetup('setOptions', [['cookie_secure' => $value]]); } - - if (!empty($this->config['sameSiteProtection'])) { - $builder->getDefinitionByType(Nette\Http\Session::class) - ->addSetup('setOptions', [['cookie_samesite' => 'Lax']]); - } } diff --git a/tests/Http.DI/HttpExtension.sameSiteProtection.phpt b/tests/Http.DI/HttpExtension.sameSiteProtection.phpt index 90c5152e..098bd57c 100644 --- a/tests/Http.DI/HttpExtension.sameSiteProtection.phpt +++ b/tests/Http.DI/HttpExtension.sameSiteProtection.phpt @@ -36,4 +36,4 @@ Assert::contains( : 'Set-Cookie: nette-samesite=1; path=/; SameSite=Strict; HttpOnly', $headers ); -Assert::same('Lax', $container->getService('session.session')->getOptions()['cookie_samesite']); +Assert::true(empty($container->getService('session.session')->getOptions()['cookie_samesite']));