I'm trying to figure out how to set the SameSite cookie attribute for Drupal 8 session cookies, but I can't find a solution.
I thought SessionConfiguration might give me enough options, but it seems not.
Where can I perform such magic?
Drupal Answers is a question and answer site for Drupal developers and administrators. It only takes a minute to sign up.
Sign up to join this communityI'm trying to figure out how to set the SameSite cookie attribute for Drupal 8 session cookies, but I can't find a solution.
I thought SessionConfiguration might give me enough options, but it seems not.
Where can I perform such magic?
Check this issue https://www.drupal.org/project/drupal/issues/3150614 You could set the following configuration in services.yml
parameters:
session.storage.options:
cookie_samesite: strict
Late to the party, but maybe still of use to someone.
In an environment where you can't control services.yml
, e.g. because your organisation/client doesn't let you edit it (for security/compliance reasons for example) and if ini_set('session.cookie_samesite', 'strict')
is not an option for you (PHP > 7.3 according to https://www.php.net/manual/en/session.security.ini.php), you can use a session decorator.
You need a service definition, e.g. my_modules.services.yml
services:
my_module.session_configuration:
class: Drupal\my_module\Session\SessionConfiguration
decorates: session_configuration
decoration_priority: 9
public: false
arguments: ['@my_module.session_configuration.inner']
And the actual class, e.g. my_module\src\Session\SessionConfiguration.php
:
namespace Drupal\my_module\Session;
use Symfony\Component\HttpFoundation\Request;
use Drupal\Core\Session\SessionConfigurationInterface;
class SessionConfiguration implements SessionConfigurationInterface {
/**
* Original service object.
*
* @var \Drupal\core\Session\SessionConfigurationInterface
*/
protected $sessionConfiguration;
/**
* Constructs a new Session Configuration instance.
*
* @param \Drupal\core\Session\SessionConfigurationInterface $session_configuration
* The original session configuration service.
*/
public function __construct(SessionConfigurationInterface $session_configuration) {
$this->sessionConfiguration = $session_configuration;
}
/**
* {@inheritdoc}
*/
public function hasSession(Request $request) {
return $this->sessionConfiguration->hasSession($request);
}
/**
* {@inheritdoc}
*/
public function getOptions(Request $request) {
$options = $this->sessionConfiguration->getOptions($request);
$options['cookie_samesite'] = 'Strict';
return $options;
}
}
I saw variations of this decorator pattern in different examples on the web, sometimes extending the base service and sometimes implementing the appropriate interface instead. There is a good discussion about this here: https://www.phase2technology.com/blog/using-symfony-service-decorators-drupal-8
services.yml
, e.g. for security/compliance reasons.