-
-
Notifications
You must be signed in to change notification settings - Fork 246
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
SameSite "strict" attribute to session cookie inhibits from login with yii2-authclients #294
Comments
I think good idea use ; http://php.net/session.cookie-secure
session.cookie_secure = 1
; Whether or not to add the httpOnly flag to the cookie, which makes it
; inaccessible to browser scripting languages such as JavaScript.
; http://php.net/session.cookie-httponly
session.cookie_httponly = 1
; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF)
; Current valid values are "Lax" or "Strict"
; https://tools.ietf.org/html/draft-west-first-party-cookies-07
session.cookie_samesite = 'Strict' Ok, lets go. If you use But if
|
If you are facing login concern due to Identify Cookies, for the PHP version < 7.3, you can set the value of sameSite Attribute None as: Edit your main.php file
And for session cookie, modify the cookieParam as:
Note: You may need to edit the file: yii\web\Cookie, by updating the value of $path from '/' to '/;SameSite=None'. I hope this will help. |
In main.php set-up the attributes to session cookie.
The sameSite attibute to strict:
I expect to login with my social buttons (eg: google and facebook)
The login process works well, but I'm not logged after it.
Using sameSite value to lax everything work well.
If I understood correctly the situation this could be totally fine, I mean, not a code problem, but I think this situation has to be documented.
The text was updated successfully, but these errors were encountered: