Skip to content

Commit 89b8d8f

Browse files
evansimsevansims
authored
[SDK-3635] Enable configuration of SessionStore and CookieStore samesite property (#645)
1 parent ef7f4a3 commit 89b8d8f

File tree

4 files changed

+63
-35
lines changed

4 files changed

+63
-35
lines changed

‎src/Configuration/SdkConfiguration.php

+5
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@
2727
* @method SdkConfiguration setCookieDomain(?string $cookieDomain = null)
2828
* @method SdkConfiguration setCookieExpires(int $cookieExpires = 0)
2929
* @method SdkConfiguration setCookiePath(string $cookiePath = '/')
30+
* @method SdkConfiguration setCookieSameSite(?string $cookieSameSite)
3031
* @method SdkConfiguration setCookieSecret(?string $cookieSecret)
3132
* @method SdkConfiguration setCookieSecure(bool $cookieSecure = false)
3233
* @method SdkConfiguration setClientId(?string $clientId = null)
@@ -69,6 +70,7 @@
6970
* @method string|null getCookieDomain(?\Throwable $exceptionIfNull = null)
7071
* @method int getCookieExpires()
7172
* @method string getCookiePath()
73+
* @method string|null getCookieSameSite(?\Throwable $exceptionIfNull = null)
7274
* @method string|null getCookieSecret(?\Throwable $exceptionIfNull = null)
7375
* @method bool getCookieSecure()
7476
* @method string|null getClientId(?\Throwable $exceptionIfNull = null)
@@ -111,6 +113,7 @@
111113
* @method bool hasCookieDomain()
112114
* @method bool hasCookieExpires()
113115
* @method bool hasCookiePath()
116+
* @method bool hasCookieSameSite()
114117
* @method bool hasCookieSecret()
115118
* @method bool hasCookieSecure()
116119
* @method bool hasClientId()
@@ -200,6 +203,7 @@ final class SdkConfiguration implements ConfigurableContract
200203
* @param string|null $cookieDomain Defaults to value of HTTP_HOST server environment information. Cookie domain, for example 'www.example.com', for use with PHP sessions and SDK cookies. To make cookies visible on all subdomains then the domain must be prefixed with a dot like '.example.com'.
201204
* @param int $cookieExpires Defaults to 0. How long, in seconds, before cookies expire. If set to 0 the cookie will expire at the end of the session (when the browser closes).
202205
* @param string $cookiePath Defaults to '/'. Specifies path on the domain where the cookies will work. Use a single slash ('/') for all paths on the domain.
206+
* @param string|null $cookieSameSite Defaults to 'lax'. Specifies whether cookies should be restricted to first-party or same-site context.
203207
* @param bool $cookieSecure Defaults to false. Specifies whether cookies should ONLY be sent over secure connections.
204208
* @param bool $persistUser Defaults to true. If true, the user data will persist in session storage.
205209
* @param bool $persistIdToken Defaults to true. If true, the Id Token will persist in session storage.
@@ -247,6 +251,7 @@ public function __construct(
247251
int $cookieExpires = 0,
248252
string $cookiePath = '/',
249253
bool $cookieSecure = false,
254+
?string $cookieSameSite = null,
250255
bool $persistUser = true,
251256
bool $persistIdToken = true,
252257
bool $persistAccessToken = true,

‎src/Store/CookieStore.php

+41-34
Original file line numberDiff line numberDiff line change
@@ -211,6 +211,7 @@ public function setState(): self
211211
// Push the updated cookie to the host device for persistence.
212212
// @codeCoverageIgnoreStart
213213
if (! defined('AUTH0_TESTS_DIR')) {
214+
/** @var array{expires?: int, path?: string, domain?: string, secure?: bool, httponly?: bool, samesite?: 'Lax'|'lax'|'None'|'none'|'Strict'|'strict', url_encode?: int} $setOptions */
214215
setcookie($cookieName, $chunk, $setOptions);
215216
}
216217
// @codeCoverageIgnoreEnd
@@ -231,6 +232,7 @@ public function setState(): self
231232
// Push the cookie deletion command to the host device.
232233
// @codeCoverageIgnoreStart
233234
if (! defined('AUTH0_TESTS_DIR')) {
235+
/** @var array{expires?: int, path?: string, domain?: string, secure?: bool, httponly?: bool, samesite?: 'Lax'|'lax'|'None'|'none'|'Strict'|'strict', url_encode?: int} $deleteOptions */
234236
setcookie($cookieName, '', $deleteOptions);
235237
}
236238
// @codeCoverageIgnoreEnd
@@ -320,6 +322,45 @@ public function purge(): void
320322
}
321323
}
322324

325+
326+
/**
327+
* Build options array for use with setcookie()
328+
*
329+
* @param int|null $expires
330+
*
331+
* @return array{expires: int, path: string, domain?: string, secure: bool, httponly: bool, samesite: string, url_encode?: int}
332+
*/
333+
public function getCookieOptions(
334+
?int $expires = null
335+
): array {
336+
$expires = $expires ?? $this->configuration->getCookieExpires();
337+
338+
if ($expires !== 0) {
339+
$expires = time() + $expires;
340+
}
341+
342+
$options = [
343+
'expires' => $expires,
344+
'path' => $this->configuration->getCookiePath(),
345+
'secure' => $this->configuration->getCookieSecure(),
346+
'httponly' => true,
347+
'samesite' => $this->configuration->getResponseMode() === 'form_post' ? 'None' : $this->configuration->getCookieSameSite() ?? 'Lax'
348+
];
349+
350+
if (! in_array(strtolower($options['samesite']), ['lax', 'none', 'strict'], true)) {
351+
$options['samesite'] = 'Lax';
352+
}
353+
354+
$domain = $this->configuration->getCookieDomain() ?? $_SERVER['HTTP_HOST'] ?? null;
355+
356+
if ($domain !== null) {
357+
/** @var string $domain */
358+
$options['domain'] = $domain;
359+
}
360+
361+
return $options;
362+
}
363+
323364
/**
324365
* Encrypt data for safe storage format for a cookie.
325366
*
@@ -443,38 +484,4 @@ private function decrypt(
443484
/** @var array<mixed> $data */
444485
return $data;
445486
}
446-
447-
/**
448-
* Build options array for use with setcookie()
449-
*
450-
* @param int|null $expires
451-
*
452-
* @return array{expires?: int, path?: string, domain?: string, secure?: bool, httponly?: bool, samesite?: 'Lax'|'lax'|'None'|'none'|'Strict'|'strict', url_encode?: int}
453-
*/
454-
private function getCookieOptions(
455-
?int $expires = null
456-
): array {
457-
$expires = $expires ?? $this->configuration->getCookieExpires();
458-
459-
if ($expires !== 0) {
460-
$expires = time() + $expires;
461-
}
462-
463-
$options = [
464-
'expires' => $expires,
465-
'path' => $this->configuration->getCookiePath(),
466-
'secure' => $this->configuration->getCookieSecure(),
467-
'httponly' => true,
468-
'samesite' => $this->configuration->getResponseMode() === 'form_post' ? 'None' : 'Lax',
469-
];
470-
471-
$domain = $this->configuration->getCookieDomain() ?? $_SERVER['HTTP_HOST'] ?? null;
472-
473-
if ($domain !== null) {
474-
/** @var string $domain */
475-
$options['domain'] = $domain;
476-
}
477-
478-
return $options;
479-
}
480487
}

‎src/Store/SessionStore.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -157,7 +157,7 @@ private function start(): void
157157
'path' => $this->configuration->getCookiePath(),
158158
'secure' => $this->configuration->getCookieSecure(),
159159
'httponly' => true,
160-
'samesite' => $this->configuration->getResponseMode() === 'form_post' ? 'None' : 'Lax',
160+
'samesite' => $this->configuration->getResponseMode() === 'form_post' ? 'None' : $this->configuration->getCookieSameSite() ?? 'Lax',
161161
]);
162162
}
163163
// @codeCoverageIgnoreEnd

‎tests/Unit/Store/CookieStoreTest.php

+16
Original file line numberDiff line numberDiff line change
@@ -222,3 +222,19 @@
222222

223223
expect($this->store->getState())->toBeEmpty();
224224
});
225+
226+
test('Configured SameSite() is reflected', function(): void {
227+
$this->configuration->setCookieSameSite('strict');
228+
229+
$options = $this->store->getCookieOptions();
230+
231+
expect($options['samesite'])->toEqual('strict');
232+
});
233+
234+
test('Unsupported configured SameSite() is overwritten by default of `lax`', function(): void {
235+
$this->configuration->setCookieSameSite('testing');
236+
237+
$options = $this->store->getCookieOptions();
238+
239+
expect($options['samesite'])->toEqual('Lax');
240+
});

0 commit comments

Comments
 (0)