Do cookies set by Joomla need changes because of the new samesite requirement?

Question

We have a custom app that uses a parameter in the URL to track sessions. However, as per this screenshot, we seem to be setting a cookie called PHPSESSID.

Could it be a Joomla cookie?

Answer 1

PHPSESSID is a server generated session cookie. If your server is on PHP7.3+ you can set samesite and secure parameters for it in php.ini

Along the lines of:

session.cookie_secure=On

session.cookie_samesite="Lax" (or "None" or "Strict")

As for the topic question, yes, once it becomes a requirement, all cookies will need changing, be it Joomla (including extensions if they use cookies) or not. As far as I can see they've already addressed it for J4 a while back. https://issues.joomla.org/tracker/joomla-cms/25414

Answer 2

A temporary solution for Joomla 3.9.x (same code for older versions but in different path, check at libraries\joomla\input\cookie.php)

Modify /libraries/src/Input/Cookie.php

Replace whole function set (line 89) with

public function set($name, $value, $expire = 0, $path = '', $domain = '', $secure = false, $httpOnly = false, $samesite=null)
{
    if (is_array($value))
    {
        foreach ($value as $key => $val)
        {
            $this->cookieHelper($name . "[$key]", $val, $expire, $path, $domain, $secure, $httpOnly,$samesite);
        }
    }
    else
    {
        $this->cookieHelper($name, $value, $expire, $path, $domain, $secure, $httpOnly,$samesite);
    }

    $this->data[$name] = $value;
}

protected function cookieHelper($name, $value, $expire = 0, $path = '', $domain = '', $secure = false, $httpOnly = false, $samesite=null)
{
    $defSameSite=ini_get('session.cookie_samesite')?ini_get('session.cookie_samesite'):'None';
    $samesite=is_null($samesite) || !in_array(strtolower($samesite),array('none','lax','strict'))?$defSameSite:$samesite;

    if (PHP_VERSION_ID < 70300)
    {
        setcookie($name, $value, $expire,$path."; samesite=".$samesite, $domain, $secure, $httponly);
    }
    else
    {
        setcookie($name, $value, [
            'expires' => $expire,
            'path' => $path,
            'domain' => $domain,
            'secure' => $secure,
            'httponly' => $httponly,
            'samesite' => $samesite,
        ]);
    }
}

Now you can set globally from php.ini or php the code, the value of "SameSite"

php.ini

session.cookie_samesite=None

PHP Code

ini_set('session.cookie_samesite','None');