This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Browse the repository at this point in the history
[Security] Fix SameSite cookie CSRF protection (#7539)
1. The session variable that indicates to use it was set to "true". However, it should be a string indicating the value to use (either "strict" or "lax"). See: https://www.php.net/manual/en/session.configuration.php#ini.session.cookie-samesite 2. The use_strict_mode setting (See: https://www.php.net/manual/en/session.configuration.php#ini.session.use-strict-mode) in PHP is not enabled by default. This means that, even when logging out, the session_destroy/session_start procedure reuses the old cookie and does not set a new cookie with the proper samesite flag. All the PHP documentation I've seen says use_strict_mode should always be enabled, but defaults to disabled. This explicitly overrides the php.ini setting (default false) to set it at the beginning of the code, ensuring that NDB_Client properly generates a new session cookie.
- Loading branch information
Showing 4 changed files with 12 additions and 2 deletions.