nextcloud /
server
| @@ 490-516 (lines=27) @@ | ||
| 487 | /** |
|
| 488 | * Send the same site cookies |
|
| 489 | */ |
|
| 490 | private static function sendSameSiteCookies() { |
|
| 491 | $cookieParams = session_get_cookie_params(); |
|
| 492 | $secureCookie = ($cookieParams['secure'] === true) ? 'secure; ' : ''; |
|
| 493 | $policies = [ |
|
| 494 | 'lax', |
|
| 495 | 'strict', |
|
| 496 | ]; |
|
| 497 | ||
| 498 | // Append __Host to the cookie if it meets the requirements |
|
| 499 | $cookiePrefix = ''; |
|
| 500 | if($cookieParams['secure'] === true && $cookieParams['path'] === '/') { |
|
| 501 | $cookiePrefix = '__Host-'; |
|
| 502 | } |
|
| 503 | ||
| 504 | foreach($policies as $policy) { |
|
| 505 | header( |
|
| 506 | sprintf( |
|
| 507 | 'Set-Cookie: %snc_sameSiteCookie%s=true; path=%s; httponly;' . $secureCookie . 'expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=%s', |
|
| 508 | $cookiePrefix, |
|
| 509 | $policy, |
|
| 510 | $cookieParams['path'], |
|
| 511 | $policy |
|
| 512 | ), |
|
| 513 | false |
|
| 514 | ); |
|
| 515 | } |
|
| 516 | } |
|
| 517 | ||
| 518 | /** |
|
| 519 | * Same Site cookie to further mitigate CSRF attacks. This cookie has to |
|
| @@ 79-105 (lines=27) @@ | ||
| 76 | throw $exception; |
|
| 77 | } |
|
| 78 | ||
| 79 | protected function setSameSiteCookie() { |
|
| 80 | $cookieParams = $this->request->getCookieParams(); |
|
| 81 | $secureCookie = ($cookieParams['secure'] === true) ? 'secure; ' : ''; |
|
| 82 | $policies = [ |
|
| 83 | 'lax', |
|
| 84 | 'strict', |
|
| 85 | ]; |
|
| 86 | ||
| 87 | // Append __Host to the cookie if it meets the requirements |
|
| 88 | $cookiePrefix = ''; |
|
| 89 | if($cookieParams['secure'] === true && $cookieParams['path'] === '/') { |
|
| 90 | $cookiePrefix = '__Host-'; |
|
| 91 | } |
|
| 92 | ||
| 93 | foreach($policies as $policy) { |
|
| 94 | header( |
|
| 95 | sprintf( |
|
| 96 | 'Set-Cookie: %snc_sameSiteCookie%s=true; path=%s; httponly;' . $secureCookie . 'expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=%s', |
|
| 97 | $cookiePrefix, |
|
| 98 | $policy, |
|
| 99 | $cookieParams['path'], |
|
| 100 | $policy |
|
| 101 | ), |
|
| 102 | false |
|
| 103 | ); |
|
| 104 | } |
|
| 105 | } |
|
| 106 | } |
|
| 107 | ||
