From 565aff35f6ff25113fc953f514b2e83f6e68fc0b Mon Sep 17 00:00:00 2001
From: johnnyq <johnny@pittpc.com>
Date: Fri, 24 Jul 2026 14:09:52 -0400
Subject: [PATCH] Set SameSite=Lax on the session cookie

Applied at all seven session_start sites. keepalive.php and guest_post.php
had no cookie flags at all and now set httponly and secure too.
---
 client/includes/check_login.php | 1 +
 client/login_microsoft.php      | 1 +
 client/login_reset.php          | 1 +
 guest/guest_post.php            | 5 +++++
 includes/session_init.php       | 1 +
 keepalive.php                   | 7 +++++++
 login.php                       | 1 +
 7 files changed, 17 insertions(+)

diff --git a/client/includes/check_login.php b/client/includes/check_login.php
index 8aababd4..faab4e63 100644
--- a/client/includes/check_login.php
+++ b/client/includes/check_login.php
@@ -8,6 +8,7 @@
 if (!isset($_SESSION)) {
     // HTTP Only cookies
     ini_set("session.cookie_httponly", true);
+    ini_set("session.cookie_samesite", "Lax");
     if ($config_https_only) {
         // Tell client to only send cookie(s) over HTTPS
         ini_set("session.cookie_secure", true);
diff --git a/client/login_microsoft.php b/client/login_microsoft.php
index b738cfdb..69ff045f 100644
--- a/client/login_microsoft.php
+++ b/client/login_microsoft.php
@@ -10,6 +10,7 @@ require_once '../functions.php';
 if (!isset($_SESSION)) {
     // HTTP Only cookies
     ini_set("session.cookie_httponly", true);
+    ini_set("session.cookie_samesite", "Lax");
     if ($config_https_only) {
         // Tell client to only send cookie(s) over HTTPS
         ini_set("session.cookie_secure", true);
diff --git a/client/login_reset.php b/client/login_reset.php
index fc18d6e3..3007bb2b 100644
--- a/client/login_reset.php
+++ b/client/login_reset.php
@@ -25,6 +25,7 @@ if($config_client_portal_enable == 0) {
 if (!isset($_SESSION)) {
     // HTTP Only cookies
     ini_set("session.cookie_httponly", true);
+    ini_set("session.cookie_samesite", "Lax");
     if ($config_https_only) {
         // Tell client to only send cookie(s) over HTTPS
         ini_set("session.cookie_secure", true);
diff --git a/guest/guest_post.php b/guest/guest_post.php
index c766a304..7cec8a95 100644
--- a/guest/guest_post.php
+++ b/guest/guest_post.php
@@ -4,6 +4,11 @@ require_once "../config.php";
 require_once "../functions.php";
 require_once "../includes/load_global_settings.php";
 
+ini_set("session.cookie_httponly", true);
+ini_set("session.cookie_samesite", "Lax");
+if ($config_https_only) {
+    ini_set("session.cookie_secure", true);
+}
 session_start();
 
 require_once "../includes/inc_set_timezone.php"; // Must be included after session_start to work
diff --git a/includes/session_init.php b/includes/session_init.php
index 1a84275d..35985bcc 100644
--- a/includes/session_init.php
+++ b/includes/session_init.php
@@ -3,6 +3,7 @@
 if (!isset($_SESSION)) {
     // HTTP Only cookies
     ini_set("session.cookie_httponly", true);
+    ini_set("session.cookie_samesite", "Lax");
     
     if ($config_https_only) {
         // Tell client to only send cookie(s) over HTTPS
diff --git a/keepalive.php b/keepalive.php
index 63df5d4d..0158135b 100644
--- a/keepalive.php
+++ b/keepalive.php
@@ -4,5 +4,12 @@
 // Receives requests via AJAX in the background every 8 mins to prevent PHP garbage collection ending sessions
 //  See footer.php & js/keepalive.js
 
+require_once __DIR__ . "/config.php";
+
+ini_set("session.cookie_httponly", true);
+ini_set("session.cookie_samesite", "Lax");
+if ($config_https_only) {
+    ini_set("session.cookie_secure", true);
+}
 session_start();
 session_write_close();
diff --git a/login.php b/login.php
index 02bbd423..8436eef4 100644
--- a/login.php
+++ b/login.php
@@ -15,6 +15,7 @@ require_once "libs/totp/totp.php";
 
 if (session_status() === PHP_SESSION_NONE) {
     ini_set("session.cookie_httponly", true);
+    ini_set("session.cookie_samesite", "Lax");
 
     if ($config_https_only || !isset($config_https_only)) {
         ini_set("session.cookie_secure", true);