Restore old SameSite behavior if not HTTPS

ucfopen · Oct 14, 2024 · 7669ad9 · 7669ad9
1 parent 4885c0a
commit 7669ad9
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/fuel/app/config/config.php b/fuel/app/config/config.php
@@ -208,7 +208,7 @@
 		// Only transmit cookies over HTTP, disabling Javascript access
 		// 'http_only'   => false,
 		// Samesite restrictions on cookie, options include Lax, Strict or None.
-		'same_site' => 'None',
+		'same_site'   => (isset($_SERVER['HTTPS']) and $_SERVER['HTTPS']) ? 'None' : 'Strict',
 	),
 
 	/**

diff --git a/fuel/app/config/session.php b/fuel/app/config/session.php
@@ -13,5 +13,5 @@
 			]
 		],
 		'expiration_time' => $_ENV['SESSION_EXPIRATION'] ?? null,
-		'cookie_same_site' => 'None',
+		'cookie_same_site' => (isset($_SERVER['HTTPS']) and $_SERVER['HTTPS']) ? 'None' : 'Strict',
 ];