nextcloud /
server
| @@ 79-105 (lines=27) @@ | ||
| 76 | throw $exception; |
|
| 77 | } |
|
| 78 | ||
| 79 | protected function setSameSiteCookie() { |
|
| 80 | $cookieParams = $this->request->getCookieParams(); |
|
| 81 | $secureCookie = ($cookieParams['secure'] === true) ? 'secure; ' : ''; |
|
| 82 | $policies = [ |
|
| 83 | 'lax', |
|
| 84 | 'strict', |
|
| 85 | ]; |
|
| 86 | ||
| 87 | // Append __Host to the cookie if it meets the requirements |
|
| 88 | $cookiePrefix = ''; |
|
| 89 | if($cookieParams['secure'] === true && $cookieParams['path'] === '/') { |
|
| 90 | $cookiePrefix = '__Host-'; |
|
| 91 | } |
|
| 92 | ||
| 93 | foreach($policies as $policy) { |
|
| 94 | header( |
|
| 95 | sprintf( |
|
| 96 | 'Set-Cookie: %snc_sameSiteCookie%s=true; path=%s; httponly;' . $secureCookie . 'expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=%s', |
|
| 97 | $cookiePrefix, |
|
| 98 | $policy, |
|
| 99 | $cookieParams['path'], |
|
| 100 | $policy |
|
| 101 | ), |
|
| 102 | false |
|
| 103 | ); |
|
| 104 | } |
|
| 105 | } |
|
| 106 | } |
|
| 107 | ||
| @@ 475-501 (lines=27) @@ | ||
| 472 | /** |
|
| 473 | * Send the same site cookies |
|
| 474 | */ |
|
| 475 | private static function sendSameSiteCookies() { |
|
| 476 | $cookieParams = session_get_cookie_params(); |
|
| 477 | $secureCookie = ($cookieParams['secure'] === true) ? 'secure; ' : ''; |
|
| 478 | $policies = [ |
|
| 479 | 'lax', |
|
| 480 | 'strict', |
|
| 481 | ]; |
|
| 482 | ||
| 483 | // Append __Host to the cookie if it meets the requirements |
|
| 484 | $cookiePrefix = ''; |
|
| 485 | if($cookieParams['secure'] === true && $cookieParams['path'] === '/') { |
|
| 486 | $cookiePrefix = '__Host-'; |
|
| 487 | } |
|
| 488 | ||
| 489 | foreach($policies as $policy) { |
|
| 490 | header( |
|
| 491 | sprintf( |
|
| 492 | 'Set-Cookie: %snc_sameSiteCookie%s=true; path=%s; httponly;' . $secureCookie . 'expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=%s', |
|
| 493 | $cookiePrefix, |
|
| 494 | $policy, |
|
| 495 | $cookieParams['path'], |
|
| 496 | $policy |
|
| 497 | ), |
|
| 498 | false |
|
| 499 | ); |
|
| 500 | } |
|
| 501 | } |
|
| 502 | ||
| 503 | /** |
|
| 504 | * Same Site cookie to further mitigate CSRF attacks. This cookie has to |
|
