2

We have a custom app that uses a parameter in the URL to track sessions. However, as per this screenshot, we seem to be setting a cookie called PHPSESSID.

Is cookie set?

Could it be a Joomla cookie?

3

PHPSESSID is a server generated session cookie. If your server is on PHP7.3+ you can set samesite and secure parameters for it in php.ini

Along the lines of:

session.cookie_secure=On

session.cookie_samesite="Lax" (or "None" or "Strict")

As for the topic question, yes, once it becomes a requirement, all cookies will need changing, be it Joomla (including extensions if they use cookies) or not. As far as I can see they've already addressed it for J4 a while back. https://issues.joomla.org/tracker/joomla-cms/25414

1
  • Welcome to JSE and thank you for contributing. Please take a moment to read out tour and consider telling us about your Joomla journey in your profile. – mickmackusa Sep 11 '20 at 14:58
0

A temporary solution for Joomla 3.9.x (same code for older versions but in different path, check at libraries\joomla\input\cookie.php)

Modify /libraries/src/Input/Cookie.php

Replace whole function set (line 89) with

public function set($name, $value, $expire = 0, $path = '', $domain = '', $secure = false, $httpOnly = false, $samesite=null)
{
    if (is_array($value))
    {
        foreach ($value as $key => $val)
        {
            $this->cookieHelper($name . "[$key]", $val, $expire, $path, $domain, $secure, $httpOnly,$samesite);
        }
    }
    else
    {
        $this->cookieHelper($name, $value, $expire, $path, $domain, $secure, $httpOnly,$samesite);
    }

    $this->data[$name] = $value;
}

protected function cookieHelper($name, $value, $expire = 0, $path = '', $domain = '', $secure = false, $httpOnly = false, $samesite=null)
{
    $defSameSite=ini_get('session.cookie_samesite')?ini_get('session.cookie_samesite'):'None';
    $samesite=is_null($samesite) || !in_array(strtolower($samesite),array('none','lax','strict'))?$defSameSite:$samesite;

    if (PHP_VERSION_ID < 70300)
    {
        setcookie($name, $value, $expire,$path."; samesite=".$samesite, $domain, $secure, $httponly);
    }
    else
    {
        setcookie($name, $value, [
            'expires' => $expire,
            'path' => $path,
            'domain' => $domain,
            'secure' => $secure,
            'httponly' => $httponly,
            'samesite' => $samesite,
        ]);
    }
}

Now you can set globally from php.ini or php the code, the value of "SameSite"

php.ini

session.cookie_samesite=None

PHP Code

ini_set('session.cookie_samesite','None');

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.