search

RainLoop / rainloop-webmail

Simple, modern & fast web-based email client
http://rainloop.net
MIT License
4.08k stars 874 forks source link

Feature Request: Set 'SameSite' cookie along with 'HttpOnly' and 'Secure' ones. #2167

Open tokafondo opened 2 years ago

tokafondo commented 2 years ago

Hi and thanks for RainLoop.

I'd like to add this feature request: The 'SetCookie' function in Utils.php to set the 'SameSite' cookie. I've seen that the [labs] section in the applicactions.ini file allows to enable the 'Secure' cookie, so it would be good, security wise, to also have the 'SameSite' cookie set.

Thanks again.

the-djmaze commented 2 years ago

Replace line 513 https://github.com/RainLoop/rainloop-webmail/blob/master/rainloop/v/0.0.0/app/libraries/RainLoop/Utils.php#L513 With

        \setcookie($sName, $sValue, array(
            'expires' => $iExpire,
            'path' => $sPath,
            'domain' => $sDomain,
            'secure' => isset($_SERVER['HTTPS']) || static::$CookieDefaultSecure,
            'httponly' => $bHttpOnly,
            'samesite' => 'Strict'
        ));