CMS MADE SIMPLE FORGE

CMS Made Simple Core

 

[#12855] cookie prefix __Secure- and cookie_samesite choice between Lax or Strict

avatar
Created By: Philippe Thomas (filto)
Date Submitted: 2026-09-14 21:49

Assigned To: Fernando Morgado (JoMorg)
Resolution: None
State: Open
Summary:
cookie prefix __Secure- and cookie_samesite choice between Lax or Strict
Detailed Description:
eventualy add cookie prefix __Secure- for https front-hand request :like this:

also, choice between Lax or Strict for SameSite cookie param. (add
$config['enable_cookie_strict'] param for example )

on cms 2.2.24

lib/functions/misc.functions.php L 1268 :

-------Original-----------
#Setup session with different id and start it
$session_name = 'CMSSESSID'.substr(md5(__DIR__.CMS_VERSION), 0, 12);
if( !isset($CMS_INSTALL_PAGE) ) {
        $config = cms_config::get_instance();
        @session_name($session_name);
        @ini_set('url_rewriter.tags', '');
        @ini_set('session.use_trans_sid', 0);
        @ini_set('session.use_only_cookies', 1);
        @ini_set('session.cookie_httponly', 1);
@ini_set('session.cookie_secure',
CmsApp::get_instance()->is_https_request() ? '1' : '0');
        if( empty($config['disable_cookie_samesite']) ) {
            @ini_set('session.cookie_samesite', 'Lax');
        }
}
-------Modified ----------------

#Setup session with different id and start it
$session_name = 'CMSSESSID'.substr(md5(__DIR__.CMS_VERSION), 0, 12);
if( !isset($CMS_INSTALL_PAGE) ) {
        $config = cms_config::get_instance();

      /******* add __Secure-  cookie prefix *****/
     if(CmsApp::get_instance()->is_https_request() )
       { $session_name = '__Secure-'.$session_name;}

        @session_name($session_name);
        @ini_set('url_rewriter.tags', '');
        @ini_set('session.use_trans_sid', 0);
        @ini_set('session.use_only_cookies', 1);
        @ini_set('session.cookie_httponly', 1);
@ini_set('session.cookie_secure',
CmsApp::get_instance()->is_https_request() ? '1' : '0');
        if( empty($config['disable_cookie_samesite']) ) {

            /****** Lax or Strict choice **** */
@ini_set('session.cookie_samesite',
empty($config['enable_cookie_strict'])?'Lax':'Strict');
        }
}
---------------------------
works for me

Note : cookie prefix __Host- is not possible to set on some servers cause they
add cookie domain (not allowed with this prefix).

History