rfc:same-site-cookie
Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
rfc:same-site-cookie [2017/07/17 20:18] – f.bosch_genkgo.nl | rfc:same-site-cookie [2022/11/21 11:07] (current) – Point commits to GitHub girgias | ||
---|---|---|---|
Line 4: | Line 4: | ||
* Author of RFC and creator of PR: Frederik Bosch, f.bosch@genkgo.nl | * Author of RFC and creator of PR: Frederik Bosch, f.bosch@genkgo.nl | ||
* Author of original patch: xistence at 0x90 dot nl | * Author of original patch: xistence at 0x90 dot nl | ||
- | * Status: | + | * Status: |
* First Published at: https:// | * First Published at: https:// | ||
===== Introduction ===== | ===== Introduction ===== | ||
Same-site cookies allow servers to mitigate the risk of CSRF and information leakage attacks by asserting that a particular cookie should only be sent with requests initiated from the same registrable domain. The technology is currently [[https:// | Same-site cookies allow servers to mitigate the risk of CSRF and information leakage attacks by asserting that a particular cookie should only be sent with requests initiated from the same registrable domain. The technology is currently [[https:// | ||
+ | |||
+ | ===== How the samesite flag works ===== | ||
+ | |||
+ | Cookies are issued using the Set-Cookie header. When issuing a cookie, one can set a key and value together with flags for the browser to determine whether the cookie should be accessible. A typical cookie might look like this. | ||
+ | |||
+ | < | ||
+ | Set-Cookie: key=value; path=/; domain=example.org; | ||
+ | </ | ||
+ | |||
+ | As many will know, this opens doors for CSRF attacks, an attack that forces an end user to execute unwanted actions on a web application in which they' | ||
+ | |||
+ | According to the proposed standard, there are now two possibilities for a cookie that is using the samesite flag: " | ||
+ | |||
+ | A cookie that is issued using the samesite flag, might look as follows. | ||
+ | |||
+ | < | ||
+ | Set-Cookie: key=value; path=/; domain=example.org; | ||
+ | </ | ||
===== Proposal ===== | ===== Proposal ===== | ||
- | According to the proposed standard, there are now two possibilities for a cookie that is using the samesite flag: " | + | In order to add this < |
- setcookie | - setcookie | ||
Line 18: | Line 36: | ||
- session_set_cookie_params | - session_set_cookie_params | ||
- session_get_cookie_params | - session_get_cookie_params | ||
+ | |||
+ | The first three functions have a similar function signature. This RFC proposes two possibilities to change these three functions. The first possibility is to add an additional argument to these functions. The second possibility is to allow an array of options in which all the cookie options will be moved into. | ||
+ | |||
+ | When voting, one can decide to (a) accept/ | ||
==== setcookie ==== | ==== setcookie ==== | ||
- | The syntax of the setcookie function will get an extra argument | + | 1. Add an additional |
<code php> | <code php> | ||
bool setcookie ( string $name [, string $value = "" | bool setcookie ( string $name [, string $value = "" | ||
+ | </ | ||
+ | |||
+ | 2. Modify setcookie as such that the function also allows an array of options. The keys within $options that have affect to the Set-Cookie header are: path, domain, secure, httponly and samesite. The default values for these options will remain untouched. The default value for samesite will be the empty string. | ||
+ | |||
+ | <code php> | ||
+ | bool setcookie ( string $name [, string $value = "" | ||
+ | bool setcookie ( string $name [, string $value = "" | ||
</ | </ | ||
==== setrawcookie ==== | ==== setrawcookie ==== | ||
- | The syntax of the setrawcookie function will get an extra argument | + | 1. Add an additional |
<code php> | <code php> | ||
bool setrawcookie ( string $name [, string $value [, int $expire = 0 [, string $path [, string $domain [, bool $secure = false [, bool $httponly = false [, string $samesite = "" | bool setrawcookie ( string $name [, string $value [, int $expire = 0 [, string $path [, string $domain [, bool $secure = false [, bool $httponly = false [, string $samesite = "" | ||
+ | </ | ||
+ | |||
+ | 2. Modify setrawcookie as such that the function also allows an array of options. The keys within $options that have affect to the Set-Cookie header are: path, domain, secure, httponly and samesite. The default values for these options will remain untouched. The default value for samesite will be the empty string. | ||
+ | |||
+ | <code php> | ||
+ | bool setrawcookie ( string $name [, string $value = "" | ||
+ | bool setrawcookie ( string $name [, string $value = "" | ||
</ | </ | ||
==== session_set_cookie_params ==== | ==== session_set_cookie_params ==== | ||
- | The syntax of the session_set_cookie_param function will get an extra argument | + | 1. Add an additional |
<code php> | <code php> | ||
void session_set_cookie_params ( int $lifetime [, string $path [, string $domain [, bool $secure = false [, bool $httponly = false [, string $samesite = "" | void session_set_cookie_params ( int $lifetime [, string $path [, string $domain [, bool $secure = false [, bool $httponly = false [, string $samesite = "" | ||
+ | </ | ||
+ | |||
+ | 2. Modify session_set_cookie_param as such that the function also allows an array of options. The keys within $options that have affect to the Set-Cookie header are: path, domain, secure, httponly and samesite. The default values for these options will remain untouched. The default value for samesite will be the empty string. | ||
+ | |||
+ | <code php> | ||
+ | void session_set_cookie_params ( int $lifetime [, string $path [, string $domain [, bool $secure = false [, bool $httponly = false ]]]] ) | ||
+ | void session_set_cookie_params ( int $lifetime [, array $options ] ) | ||
</ | </ | ||
Line 56: | Line 99: | ||
===== Pros and cons: why or why not to adopt this RFC ===== | ===== Pros and cons: why or why not to adopt this RFC ===== | ||
- | This RFC affects the security of PHP installations. Therefore it might seem that is a no-brainer | + | The first and foremost reasons to accept this RFC is that developers will be able to better secure their PHP applications. It fits the step PHP is already making with the upcoming availability of libsodium. With this feature, |
- | === Pros === | + | But, there is a risk involved when using samesite //as additional argument// to setcookie, setrawcookie and session_set_cookie_params. The samesite cookie might not become a standard which might lead browsers to eventually drop the flag. If that would be the case, the < |
- | to be written | + | |
+ | Furthermore, | ||
+ | |||
+ | The author believes strongly that the pros weigh up to the cons. At this moment more than 50% of the global used browsers support the samesite flag. And another major browser is already working on it, being Firefox. How many PHP installations could we make more secure? We should add samesite to the core of PHP. The only question is: "What is the best route to take?" | ||
- | === Cons === | ||
- | to be written | ||
===== Backward Incompatible Changes ===== | ===== Backward Incompatible Changes ===== | ||
Line 68: | Line 112: | ||
===== Proposed PHP Version(s) ===== | ===== Proposed PHP Version(s) ===== | ||
- | next PHP 7.x | + | Next PHP 7.x. Since deadlines have passed for 7.2, this will be 7.3. |
===== RFC Impact ===== | ===== RFC Impact ===== | ||
Line 78: | Line 122: | ||
The default value is the empty string in both default development and production php.ini. | The default value is the empty string in both default development and production php.ini. | ||
+ | |||
+ | ===== Future Scope ===== | ||
+ | When this RFC will be rejected, it could mean that the current cookie functions should be left untouched and that PHP needs new functions for cookies with a better API. | ||
===== Proposed Voting Choices ===== | ===== Proposed Voting Choices ===== | ||
- | This RFC requires a 50%+1 majority. | + | This RFC requires a 50%+1 majority. |
+ | |||
+ | |||
+ | === First implementation suggestion === | ||
+ | |||
+ | |||
+ | <doodle title=" | ||
+ | * Yes | ||
+ | * No | ||
+ | </ | ||
+ | |||
+ | === Second implementation suggestion === | ||
+ | |||
+ | <doodle title=" | ||
+ | * Yes | ||
+ | * No | ||
+ | </ | ||
===== Patches and Tests ===== | ===== Patches and Tests ===== | ||
- | * [[https:// | + | * [[https:// |
+ | * Github PR with the array of options solution will be created when this RFC gets accepted | ||
+ | * Implemented via [[https:// | ||
+ | * Documented via [[https:// | ||
===== References ===== | ===== References ===== | ||
Line 90: | Line 156: | ||
* [[https:// | * [[https:// | ||
* [[https:// | * [[https:// | ||
+ | |||
+ | ===== Errata ===== | ||
+ | |||
+ | The actually implemented alternative signatures of the functions have been slightly changed from the original RFC. See the documentation in the PHP manual for details: | ||
+ | * [[http:// | ||
+ | * [[http:// | ||
+ | * [[http:// |
rfc/same-site-cookie.1500322722.txt.gz · Last modified: 2017/09/22 13:28 (external edit)