Set SameSite=strict for session cookies

Question

I'm trying to figure out how to set the SameSite cookie attribute for Drupal 8 session cookies, but I can't find a solution.

I thought SessionConfiguration might give me enough options, but it seems not.

Where can I perform such magic?

Answer 1

Check this issue https://www.drupal.org/project/drupal/issues/3150614 You could set the following configuration in services.yml

parameters:
  session.storage.options:
    cookie_samesite: strict

Answer 2

Late to the party, but maybe still of use to someone.

In an environment where you can't control services.yml, e.g. because your organisation/client doesn't let you edit it (for security/compliance reasons for example) and if ini_set('session.cookie_samesite', 'strict') is not an option for you (PHP > 7.3 according to https://www.php.net/manual/en/session.security.ini.php), you can use a session decorator.

You need a service definition, e.g. my_modules.services.yml

services:
  my_module.session_configuration:
    class: Drupal\my_module\Session\SessionConfiguration
    decorates: session_configuration
    decoration_priority: 9
    public: false
    arguments: ['@my_module.session_configuration.inner']

And the actual class, e.g. my_module\src\Session\SessionConfiguration.php:

namespace Drupal\my_module\Session;

use Symfony\Component\HttpFoundation\Request;
use Drupal\Core\Session\SessionConfigurationInterface;

class SessionConfiguration implements SessionConfigurationInterface {

  /**
   * Original service object.
   *
   * @var \Drupal\core\Session\SessionConfigurationInterface
   */
  protected $sessionConfiguration;

  /**
   * Constructs a new Session Configuration instance.
   *
   * @param \Drupal\core\Session\SessionConfigurationInterface $session_configuration
   *   The original session configuration service.
   */
  public function __construct(SessionConfigurationInterface $session_configuration) {
    $this->sessionConfiguration = $session_configuration;
  }

  /**
   * {@inheritdoc}
   */
  public function hasSession(Request $request) {
    return $this->sessionConfiguration->hasSession($request);
  }

  /**
   * {@inheritdoc}
   */
  public function getOptions(Request $request) {
    $options = $this->sessionConfiguration->getOptions($request);
    $options['cookie_samesite'] = 'Strict';
    return $options;
  }
}

I saw variations of this decorator pattern in different examples on the web, sometimes extending the base service and sometimes implementing the appropriate interface instead. There is a good discussion about this here: https://www.phase2technology.com/blog/using-symfony-service-decorators-drupal-8