会话Cookie设置SameSite = None；安全的; [英] session cookie set SameSite=None; Secure;

问题描述

服务器正在运行PHP 5.4.45版从2020年2月4日开始，默认情况下，谷歌浏览器将限制跨站点跟踪.这将导致通过iframe连接到我们网站的采购申请出现问题

the server is running PHP Version 5.4.45 Google Chrome will limit Cross-Site Tracking by default beginning February 4, 2020. Which will cause problems for a Procurement Application that connections to our website via an iframe

我需要使用SameSite = None设置会话cookie；安全；

I need to set the session cookie with SameSite=None; Secure;

任何建议将不胜感激

谢谢

推荐答案

SameSite 可从 php版本 > = 7.3 获得， php.ini 和 session_set_cookie_params()(如果以形式使用session_set_cookie_params(array $ options):布尔

SameSite is available from php version >= 7.3, in php.ini and in session_set_cookie_params() if used in the form session_set_cookie_params(array $options): bool

关于 php版本 <7.3 ... 我真的不知道是否使用 header()会覆盖 session_start()设置的选项.可能，也许我会尝试更新答案.

About php version < 7.3... I honestly don't know if usingheader()would override the options set by session_start(). it could, maybe I'll try and update the answer.

我用 php:5.6-cli (docker image，我认为是5.6.40)做了一个简单的测试，它似乎按预期工作:

I did a simple test with php:5.6-cli (docker image, I think it was 5.6.40) and it seems to work as expected:

session_start();
header('Set-Cookie: ' . session_name() . '=' . session_id() . '; SameSite=None; Secure');

默认情况下，此版本的php仅使用 key = value设置会话cookie；使用 header()的path =/被覆盖，响应中仅发送一个cookie，并且仅使用 SameSite = none发送一次；安全(已在Chromium Cookie和Wireshark数据包中验证)

By default this version of php set the session cookie only with key=value; path=/, using header() is overwritten, only one cookie is sent in the response, and only with SameSite=none; Secure (verified in Chromium cookies, and wireshark packets)

但是，我建议您使用正在使用的php版本进行测试，其行为可能会改变.

However, I would recommend testing with the version of php you are using, the behavior may change.

我个人是在考虑不使用 session_start()，将会话存储在数据库中，并使用通过 header()设置的常规cookie.

Personally I am thinking of not using session_start(), storing sessions in a db and using normal cookies set with header().

这篇关于会话Cookie设置SameSite = None；安全的;的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！