[HttpFoundation] NativeSessionStorage erases Set-Cookie headers

[eiannone]

Symfony version(s) affected: 4.2

Description
Starting or regenerating a session using NativeSessionStorage with option 'cookie_samesite' = true, erases previously set cookies.
This issue affects PHP versions < 7.3

How to reproduce

use Symfony\Component\HttpFoundation\Session\Storage\NativeSessionStorage;

$storage = new NativeSessionStorage(['cookie_samesite' => true]);

// Tries to send a cookie
setcookie("TestCookie", "foo");

// This method (and also NativeSessionStorage::regenerate()) deletes the previous cookie
$storage->start(); 

$headers = headers_list();
print_r($headers); 
// We expect 'Set-Cookie: TestCookie=foo' in the headers, but it's missing.

NOTE: To properly reproduce the problem, you must delete the PHPSESSID cookie in your browser, if exists

Possible Solution
When setting session cookie with header() function, we can prevent replacing existing "Set-Cookie" headers using the second optional parameter for header() function: replace = false.

In NativeSessionStorage class, inside start() and regenerate() methods, change this code:

header(sprintf('%s; SameSite=%s', $originalCookie, $this->emulateSameSite));

into this:

header(sprintf('%s; SameSite=%s', $originalCookie, $this->emulateSameSite), false);

[eiannone]

Affected commit are symfony/http-foundation@0daf24b and symfony/http-foundation@002b940 by @rpkamp

[rpkamp]

Nice catch! I'll create a patch somewhere this week.

[eiannone]

Thank you @rpkamp , I already submitted a pull request which fixes this: #29676