Summary:
cookie prefix __Secure- and cookie_samesite choice between Lax or Strict
Detailed Description:
eventualy add cookie prefix __Secure- for https front-hand request :like this:
also, choice between Lax or Strict for SameSite cookie param. (add
$config['enable_cookie_strict'] param for example )
on cms 2.2.24
lib/functions/misc.functions.php L 1268 :
-------Original-----------
#Setup session with different id and start it
$session_name = 'CMSSESSID'.substr(md5(__DIR__.CMS_VERSION), 0, 12);
if( !isset($CMS_INSTALL_PAGE) ) {
$config = cms_config::get_instance();
@session_name($session_name);
@ini_set('url_rewriter.tags', '');
@ini_set('session.use_trans_sid', 0);
@ini_set('session.use_only_cookies', 1);
@ini_set('session.cookie_httponly', 1);
@ini_set('session.cookie_secure',
CmsApp::get_instance()->is_https_request() ? '1' : '0');
if( empty($config['disable_cookie_samesite']) ) {
@ini_set('session.cookie_samesite', 'Lax');
}
}
-------Modified ----------------
#Setup session with different id and start it
$session_name = 'CMSSESSID'.substr(md5(__DIR__.CMS_VERSION), 0, 12);
if( !isset($CMS_INSTALL_PAGE) ) {
$config = cms_config::get_instance();
/******* add __Secure- cookie prefix *****/
if(CmsApp::get_instance()->is_https_request() )
{ $session_name = '__Secure-'.$session_name;}
@session_name($session_name);
@ini_set('url_rewriter.tags', '');
@ini_set('session.use_trans_sid', 0);
@ini_set('session.use_only_cookies', 1);
@ini_set('session.cookie_httponly', 1);
@ini_set('session.cookie_secure',
CmsApp::get_instance()->is_https_request() ? '1' : '0');
if( empty($config['disable_cookie_samesite']) ) {
/****** Lax or Strict choice **** */
@ini_set('session.cookie_samesite',
empty($config['enable_cookie_strict'])?'Lax':'Strict');
}
}
---------------------------
works for me
Note : cookie prefix __Host- is not possible to set on some servers cause they
add cookie domain (not allowed with this prefix).