AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-07-26 18:27:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

Set SameSite=Lax on the session cookie

Browse Source 
Applied at all seven session_start sites. keepalive.php and guest_post.php
had no cookie flags at all and now set httponly and secure too.
This commit is contained in:
johnnyq
2026-07-24 14:09:52 -04:00
parent 3549c2ef2a
commit 565aff35f6
7 changed files with 17 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
client/includes/check_login.php
View File

@@ -8,6 +8,7 @@
if (!isset($_SESSION)) { if (!isset($_SESSION)) {
// HTTP Only cookies // HTTP Only cookies
ini_set("session.cookie_httponly", true); ini_set("session.cookie_httponly", true);
ini_set("session.cookie_samesite", "Lax");
if ($config_https_only) { if ($config_https_only) {
// Tell client to only send cookie(s) over HTTPS // Tell client to only send cookie(s) over HTTPS
ini_set("session.cookie_secure", true); ini_set("session.cookie_secure", true);

1
client/login_microsoft.php
View File

@@ -10,6 +10,7 @@ require_once '../functions.php';
if (!isset($_SESSION)) { if (!isset($_SESSION)) {
// HTTP Only cookies // HTTP Only cookies
ini_set("session.cookie_httponly", true); ini_set("session.cookie_httponly", true);
ini_set("session.cookie_samesite", "Lax");
if ($config_https_only) { if ($config_https_only) {
// Tell client to only send cookie(s) over HTTPS // Tell client to only send cookie(s) over HTTPS
ini_set("session.cookie_secure", true); ini_set("session.cookie_secure", true);

1
client/login_reset.php
View File

@@ -25,6 +25,7 @@ if($config_client_portal_enable == 0) {
if (!isset($_SESSION)) { if (!isset($_SESSION)) {
// HTTP Only cookies // HTTP Only cookies
ini_set("session.cookie_httponly", true); ini_set("session.cookie_httponly", true);
ini_set("session.cookie_samesite", "Lax");
if ($config_https_only) { if ($config_https_only) {
// Tell client to only send cookie(s) over HTTPS // Tell client to only send cookie(s) over HTTPS
ini_set("session.cookie_secure", true); ini_set("session.cookie_secure", true);

5
guest/guest_post.php
View File

@@ -4,6 +4,11 @@ require_once "../config.php";
require_once "../functions.php"; require_once "../functions.php";
require_once "../includes/load_global_settings.php"; require_once "../includes/load_global_settings.php";
ini_set("session.cookie_httponly", true);
ini_set("session.cookie_samesite", "Lax");
if ($config_https_only) {
ini_set("session.cookie_secure", true);
}
session_start(); session_start();
require_once "../includes/inc_set_timezone.php"; // Must be included after session_start to work require_once "../includes/inc_set_timezone.php"; // Must be included after session_start to work

1
includes/session_init.php
View File

@@ -3,6 +3,7 @@
if (!isset($_SESSION)) { if (!isset($_SESSION)) {
// HTTP Only cookies // HTTP Only cookies
ini_set("session.cookie_httponly", true); ini_set("session.cookie_httponly", true);
ini_set("session.cookie_samesite", "Lax");
if ($config_https_only) { if ($config_https_only) {
// Tell client to only send cookie(s) over HTTPS // Tell client to only send cookie(s) over HTTPS

7
keepalive.php
View File

@@ -4,5 +4,12 @@
// Receives requests via AJAX in the background every 8 mins to prevent PHP garbage collection ending sessions // Receives requests via AJAX in the background every 8 mins to prevent PHP garbage collection ending sessions
// See footer.php & js/keepalive.js // See footer.php & js/keepalive.js
require_once __DIR__ . "/config.php";
ini_set("session.cookie_httponly", true);
ini_set("session.cookie_samesite", "Lax");
if ($config_https_only) {
ini_set("session.cookie_secure", true);
}
session_start(); session_start();
session_write_close(); session_write_close();

1
login.php
View File

@@ -15,6 +15,7 @@ require_once "libs/totp/totp.php";
if (session_status() === PHP_SESSION_NONE) { if (session_status() === PHP_SESSION_NONE) {
ini_set("session.cookie_httponly", true); ini_set("session.cookie_httponly", true);
ini_set("session.cookie_samesite", "Lax");
if ($config_https_only || !isset($config_https_only)) { if ($config_https_only || !isset($config_https_only)) {
ini_set("session.cookie_secure", true); ini_set("session.cookie_secure", true);