Samesite and secure cookies

[fatica]

Hi,

We have a use case where we have Joomla 3.9.26 running on PHP 7.2. We are displaying the Joomla front-end login in an IFRAME and we can see that session cookies are not set anymore due to Chrome's updated treatment of non-secure cookies that don't explicitly set the "Samesite" header component.

I discovered that this value of JConfig::cookie_path allows us to inject the SameSite=none and secure attributes

public $cookie_path = '/; SameSite=None; Secure';

This is a hack of PHP's "setcookie" function, which somewhat blindly incorporates the path and allows us to inject the proper Set-cookie header

This will likely not work with 7.3.

Reference:
https://issues.joomla.org/tracker/jooml ... ent-549181


Just posting here in case this helps anyone out. We thought for a bit that we would have to wait until all servers were upgraded and this fix helps us out in the very short term.

Thanks!