Fix Undefined property: Config\App::$cookieSameSite

[kenjis]

Description
Fixes the notice.

Notice: Undefined property: Config\App::$cookieSameSite

See https://forum.codeigniter.com/thread-78693.html.

Checklist:

• Securely signed commits
• Component(s) with PHPdocs
• Unit testing, with >80% coverage
• User guide updated
• Conforms to style guide

[WinterSilence]

need replace $config to $this, also you must use property_exists()
if (! in_array(strtolower($this->cookieSameSite), Cookie::ALLOWED_SAMESITE_VALUES, true))

[WinterSilence]

please add const SAMESITE_NONE_SECURE = 'none; secure'; to fix all cases
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite#samesitenone_requires_secure

[paulbalandan]

There is already a validation check in Cookie for Samesite None without Secure attribute.

[kenjis]

need replace $config to $this, also you must use property_exists()
if (! in_array(strtolower($this->cookieSameSite), Cookie::ALLOWED_SAMESITE_VALUES, true))

$this->cookieSameSite is deprecated.

also you must use property_exists()

Sorry, what do you mean?

[WinterSilence]

@kenjis

$config->cookieSameSite = $config->cookieSameSite ?? Cookie::SAMESITE_LAX;
if (property_exists($this, 'cookieSameSite')) {
    $this->cookieSameSite = $config->cookieSameSite;
}
if (! in_array(strtolower($config->cookieSameSite), Cookie::ALLOWED_SAMESITE_VALUES, true))

property_exists vs isset:

$o = new  stdClass();
$o->isNull = null;
var_dump(property_exists($o, 'isNull'), isset($o->isNull)); // true, false

[WinterSilence]

@paulbalandan

SameSite=None requires Secure

I can't find it in rfc6265
It's good fix but not required rule and other browsers may use none without Secure

[kenjis]

@WinterSilence Thanks.

$this->cookieSameSite surely exists and is deprecated.
So it seems the current PR code is okay.

CodeIgniter4/system/HTTP/ResponseTrait.php

Lines 102 to 109 in ebdbf0d

	/**
	* Cookie SameSite setting
	*
	* @var string
	*
	* @deprecated Use the dedicated Cookie class instead.
	*/
	protected $cookieSameSite = Cookie::SAMESITE_LAX;