Set SameSite=Lax on the session cookie

Applied at all seven session_start sites. keepalive.php and guest_post.php had no cookie flags at all and now set httponly and secure too.
2026-07-26 18:27:14 +00:00 · 2026-07-24 14:09:52 -04:00
parent 3549c2ef2a
commit 565aff35f6
7 changed files with 17 additions and 0 deletions
--- a/includes/session_init.php
+++ b/includes/session_init.php
@@ -3,6 +3,7 @@
 if (!isset($_SESSION)) {
    // HTTP Only cookies
    ini_set("session.cookie_httponly", true);
+    ini_set("session.cookie_samesite", "Lax");
    
    if ($config_https_only) {
        // Tell client to only send cookie(s) over HTTPS