[TikiWiki-commits] [Git][tikiwiki/tiki][master] [NEW] Tiki Preference: Add 'http_header_set_cookie_samesite' preference

ushindi bienvenu pushed to branch master at Tiki Wiki CMS Groupware / Tiki


Commits:
284dc4f0 by Rodriguez Nyiringabo at 2026-08-07T08:13:44+00:00
[NEW] Tiki Preference: Add 'http_header_set_cookie_samesite' preference
---
* [NEW] Tiki Preference: Add 'http_header_set_cookie_samesite' preference

See merge request tikiwiki/tiki!10603

- - - - -


5 changed files:

- lib/prefs/http.php
- lib/setup/javascript.php
- lib/tiki-js.js
- templates/admin/include_security.tpl
- tiki-setup_base.php


Changes:

=====================================
lib/prefs/http.php
=====================================
@@ -301,6 +301,21 @@ function prefs_http_list()
             ),
             'help' => 'https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers',
         ],
+        'http_header_set_cookie_samesite' => [
+            'name' => tra('HTTP header set-cookie samesite attribute'),
+            'type' => 'list',
+            'options' => [
+                '' => tra('Obey webserver configuration'),
+                'Strict' => tra('Strict'),
+                'Lax' => tra('Lax'),
+                'None' => tra('None'),
+            ],
+            'default' => '',
+            'perspective' => false,
+            'tags' => ['advanced'],
+            'description' => tra('Specifies the value of the HTTP header set-cookie samesite attribute.'),
+            'help' => 'https://doc.tiki.org/HTTP-Headers',
+        ],
         'http_header_strict_transport_security' => [
             'name' => tra('HTTP header strict-transport-security'),
             'description' => tra('The Strict-Transport-Security header (often abbreviated as HSTS) is a security feature that lets a web site tell browsers that it should only be communicated with using HTTPS, instead of using HTTP.'),


=====================================
lib/setup/javascript.php
=====================================
@@ -253,6 +253,7 @@ if (! timezone) {
     $jqueryTiki['cookie_consent_name'] = CookieConsentLib::COOKIE_CONSENT_NAME;
     $jqueryTiki['cookie_consent_categories'] = json_encode(array_keys(CookieConsentLib::getRequestedCookieCategories()));
     $jqueryTiki['cookie_consent_value'] = json_encode(CookieConsentLib::getConsentPreferences(), JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
+    $jqueryTiki['http_header_set_cookie_samesite'] = $prefs['http_header_set_cookie_samesite'] ?: session_get_cookie_params()['samesite'];
     $jqueryTiki['BUILTIN_COOKIE_CATEGORY_ESSENTIAL'] = json_encode(CookieConsentLib::BUILTIN_COOKIE_CATEGORY_ESSENTIAL);
     $jqueryTiki['wiki_url_scheme'] = $prefs['wiki_url_scheme'];
     $jqueryTiki['feature_queued_tasks'] = ($prefs['feature_queued_tasks'] ?? 'n') === 'y';


=====================================
lib/tiki-js.js
=====================================
@@ -622,7 +622,7 @@ function setCookieBrowser(name, value, section, expires, path, domain, secure) {
     }
     else {
         document.cookie = name + "=" + encodeURIComponent(value) + ((expires) ? "; expires=" + expires.toGMTString() : "")
-        + ((path) ? "; path=" + path : "") + ((domain) ? "; domain=" + domain : "") + ((secure) ? "; secure" : "" + "; samesite=Lax");
+        + ((path) ? "; path=" + path : "") + ((domain) ? "; domain=" + domain : "") + ((secure) ? "; secure" : "" + "; samesite=" + jqueryTiki.http_header_set_cookie_samesite);
     }
 }
 


=====================================
templates/admin/include_security.tpl
=====================================
@@ -185,6 +185,8 @@
                     {preference name=http_header_strict_transport_security_value}
                 </div>
 
+                {preference name=http_header_set_cookie_samesite}
+
                 {preference name=http_header_public_key_pins}
                 <div class="adminoptionboxchild" id="http_header_public_key_pins_childcontainer">
                     {preference name=http_header_public_key_pins_value}


=====================================
tiki-setup_base.php
=====================================
@@ -241,6 +241,10 @@ if ($cdn_pref) {
         exit;
     }
 }
+
+// Retrieve all preferences
+require_once('lib/setup/prefs.php');
+
 if (isset($_SERVER["REQUEST_URI"]) && ! str_contains($_SERVER['REQUEST_URI'], 'tiki-realtime.php')) {
     ini_set('session.cookie_path', str_replace("\\", "/", $tikiroot));
     if ($start_session && ini_get('session.use_cookies')) {
@@ -253,7 +257,9 @@ if (isset($_SERVER["REQUEST_URI"]) && ! str_contains($_SERVER['REQUEST_URI'], 't
             $session_params['secure'] = true;
             $session_params['samesite'] = 'None';
         } else {
-            $session_params['samesite'] = 'Lax';
+            if (! empty($prefs['http_header_set_cookie_samesite'])) {
+                $session_params['samesite'] = $prefs['http_header_set_cookie_samesite'];
+            }
         }
 
         session_set_cookie_params([
@@ -323,9 +329,6 @@ if (isset($prefs['feature_fullscreen']) && $prefs['feature_fullscreen'] == 'y')
 // Retrieve Tiki Extension Packages
 \Tiki\Package\ExtensionManager::refresh();
 
-// Retrieve all preferences
-require_once('lib/setup/prefs.php');
-
 if ($prefs['ids_enabled'] == 'y') {
     require_once 'lib/setup/ids.php';
 }



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/284dc4f0c736fb113fd75fad1c279243b2ec6c09

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/284dc4f0c736fb113fd75fad1c279243b2ec6c09
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs