I'm trying to figure out how to set the SameSite cookie attribute for Drupal 8 session cookies, but I can't find a solution.

I thought SessionConfiguration might give me enough options, but it seems not.

Where can I perform such magic?


2 Answers 2


Check this issue https://www.drupal.org/project/drupal/issues/3150614 You could set the following configuration in services.yml

    cookie_samesite: strict
  • That's for D9 not D8 Apr 12, 2021 at 10:54
  • I tried this on Drupal Core 9.3.0, still doesn't work for me. Jan 7, 2022 at 8:29
  • I actually think that should work. Did you rebuild the container after setting that?
    – cilefen
    Jan 20, 2022 at 14:46
  • The linked issue hasn't been marked as fixed, yet. That means the changes it introduces haven't been committed.
    – apaderno
    May 20, 2022 at 11:21
  • That is not true—it should work. The changes in the issue only document this hidden feature.
    – cilefen
    May 20, 2022 at 11:42

Late to the party, but maybe still of use to someone.

In an environment where you can't control services.yml, e.g. because your organisation/client doesn't let you edit it (for security/compliance reasons for example) and if ini_set('session.cookie_samesite', 'strict') is not an option for you (PHP > 7.3 according to https://www.php.net/manual/en/session.security.ini.php), you can use a session decorator.

You need a service definition, e.g. my_modules.services.yml

    class: Drupal\my_module\Session\SessionConfiguration
    decorates: session_configuration
    decoration_priority: 9
    public: false
    arguments: ['@my_module.session_configuration.inner']

And the actual class, e.g. my_module\src\Session\SessionConfiguration.php:

namespace Drupal\my_module\Session;

use Symfony\Component\HttpFoundation\Request;
use Drupal\Core\Session\SessionConfigurationInterface;

class SessionConfiguration implements SessionConfigurationInterface {

   * Original service object.
   * @var \Drupal\core\Session\SessionConfigurationInterface
  protected $sessionConfiguration;

   * Constructs a new Session Configuration instance.
   * @param \Drupal\core\Session\SessionConfigurationInterface $session_configuration
   *   The original session configuration service.
  public function __construct(SessionConfigurationInterface $session_configuration) {
    $this->sessionConfiguration = $session_configuration;

   * {@inheritdoc}
  public function hasSession(Request $request) {
    return $this->sessionConfiguration->hasSession($request);

   * {@inheritdoc}
  public function getOptions(Request $request) {
    $options = $this->sessionConfiguration->getOptions($request);
    $options['cookie_samesite'] = 'Strict';
    return $options;

I saw variations of this decorator pattern in different examples on the web, sometimes extending the base service and sometimes implementing the appropriate interface instead. There is a good discussion about this here: https://www.phase2technology.com/blog/using-symfony-service-decorators-drupal-8

  • I don't think you need all of this.
    – cilefen
    Jan 25 at 17:00
  • @cilefen And that's the downvote for?
    – berliner
    Jan 25 at 21:24
  • @cilefen While I agree that the accepted answer solves this in an environment that you control completely, my answer provides a work-around when your organisation or client doesn't let you modify services.yml, e.g. for security/compliance reasons.
    – berliner
    Jan 25 at 22:06
  • The answer doesn't explain that is the reason for the larger implementation.
    – cilefen
    Jan 25 at 22:16
  • @cilefen Ok, I added it. Makes sense. But seriously downvoting for that reason? Leave a comment and be good!
    – berliner
    Jan 25 at 23:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.