I'm trying to figure out how to set the SameSite cookie attribute for Drupal 8 session cookies, but I can't find a solution.

I thought SessionConfiguration might give me enough options, but it seems not.

Where can I perform such magic?


2 Answers 2


Check this issue https://www.drupal.org/project/drupal/issues/3150614 You could set the following configuration in services.yml

    cookie_samesite: strict
  • That's for D9 not D8 Commented Apr 12, 2021 at 10:54
  • I tried this on Drupal Core 9.3.0, still doesn't work for me. Commented Jan 7, 2022 at 8:29
  • I actually think that should work. Did you rebuild the container after setting that?
    – mona lisa
    Commented Jan 20, 2022 at 14:46
  • The linked issue hasn't been marked as fixed, yet. That means the changes it introduces haven't been committed.
    – apaderno
    Commented May 20, 2022 at 11:21
  • That is not true—it should work. The changes in the issue only document this hidden feature.
    – mona lisa
    Commented May 20, 2022 at 11:42

Late to the party, but maybe still of use to someone.

In an environment where you can't control services.yml, e.g. because your organisation/client doesn't let you edit it (for security/compliance reasons for example) and if ini_set('session.cookie_samesite', 'strict') is not an option for you (PHP > 7.3 according to https://www.php.net/manual/en/session.security.ini.php), you can use a session decorator.

You need a service definition, e.g. my_modules.services.yml

    class: Drupal\my_module\Session\SessionConfiguration
    decorates: session_configuration
    decoration_priority: 9
    public: false
    arguments: ['@my_module.session_configuration.inner']

And the actual class, e.g. my_module\src\Session\SessionConfiguration.php:

namespace Drupal\my_module\Session;

use Symfony\Component\HttpFoundation\Request;
use Drupal\Core\Session\SessionConfigurationInterface;

class SessionConfiguration implements SessionConfigurationInterface {

   * Original service object.
   * @var \Drupal\core\Session\SessionConfigurationInterface
  protected $sessionConfiguration;

   * Constructs a new Session Configuration instance.
   * @param \Drupal\core\Session\SessionConfigurationInterface $session_configuration
   *   The original session configuration service.
  public function __construct(SessionConfigurationInterface $session_configuration) {
    $this->sessionConfiguration = $session_configuration;

   * {@inheritdoc}
  public function hasSession(Request $request) {
    return $this->sessionConfiguration->hasSession($request);

   * {@inheritdoc}
  public function getOptions(Request $request) {
    $options = $this->sessionConfiguration->getOptions($request);
    $options['cookie_samesite'] = 'Strict';
    return $options;

I saw variations of this decorator pattern in different examples on the web, sometimes extending the base service and sometimes implementing the appropriate interface instead. There is a good discussion about this here: https://www.phase2technology.com/blog/using-symfony-service-decorators-drupal-8

  • I don't think you need all of this.
    – mona lisa
    Commented Jan 25, 2023 at 17:00
  • @cilefen And that's the downvote for?
    – berliner
    Commented Jan 25, 2023 at 21:24
  • @cilefen While I agree that the accepted answer solves this in an environment that you control completely, my answer provides a work-around when your organisation or client doesn't let you modify services.yml, e.g. for security/compliance reasons.
    – berliner
    Commented Jan 25, 2023 at 22:06
  • The answer doesn't explain that is the reason for the larger implementation.
    – mona lisa
    Commented Jan 25, 2023 at 22:16
  • @cilefen Ok, I added it. Makes sense. But seriously downvoting for that reason? Leave a comment and be good!
    – berliner
    Commented Jan 25, 2023 at 23:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.