I need to add the SameSite directive to my site's CSRF cookie, as explained in these mozilla security guidelines. According to the Craft docs, "Craft handles the cookie creation automatically." Is there a way I can configure the cookie?


It is actually possible but it's a little bit difficult for beginners. You'll need make use of Service Locators and overwrite craft\web\Response to change this method

foreach ($this->getCookies() as $cookie) {
    $value = $cookie->value;
    if ($cookie->expire != 1 && isset($validationKey)) {
        $value = Yii::$app->getSecurity()->hashData(serialize([$cookie->name, $value]), $validationKey);
    setcookie($cookie->name, $value, $cookie->expire, $cookie->path, $cookie->domain, $cookie->secure, $cookie->httpOnly);

setcookie is the key here, because if you use it like that, you can't really include the parameter, so you need call it accordingly with options

setcookie ( string $name [, string $value = "" [, array $options = [] ]] ) : bool

Each yii\web\Cookie only has the following Attributes

public $name;
public $value = '';
public $domain = '';
public $expire = 0;
public $path = '/';
public $secure = false;
public $httpOnly = true;

Since there is no sameSite attribut you have to think about an intelligent way to set it. There is already a feature request for it. Maybe it's easier to ask about the current status.

  • Ah thanks. I'll probably monitor the feature request. Mar 12 '19 at 17:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.