PHP Versions Question posted in
You can find a list of all versions here.

Codeigniter 3 SameSite attribute for csrf protection – Php versions

I have applications that make CORS calls to each other. Google in April 2020 will need SameSite cookies = none. https://www.chromestatus.com/feature/5633521622188032

Since chrome version 80+ all user that use chrome browser impact this csrf error. how to fix this problem on Codeigniter framework that using PHP 7.3

enter image description here

Tags:

4

Answers


  1. Chosen as BEST ANSWER
    0

    Problem is solved

    1.ADD this config at application/config/config.php for all cookie in framework

    ini_set('session.cookie_samesite', 'None');
ini_set('session.cookie_secure', TRUE);

    2.Edit this line at system/core/Security.php line ~273 replace from

    setcookie(
                        $this->_csrf_cookie_name,
                        $this->_csrf_hash,
                        $expire,
                        config_item('cookie_path'),
                        config_item('cookie_domain'),
                        $secure_cookie,
                        config_item('cookie_httponly')
                );

    to

    setcookie($this->_csrf_cookie_name, $this->_csrf_hash, ['samesite' => 'None', 'secure' => true,'expires' => $expire, 'path' => config_item('cookie_path'), 'domain' => config_item('cookie_domain'), 'httponly' => config_item('cookie_httponly')]);

    for csrf support SameSite attribute.


  2. 0

    I had this same problem but my PHP 7.2 and my CI 3.X.
    The problem was solved by making the following change to the applications / config / config.php file

    $config['cookie_prefix']    = '';
$config['cookie_domain']    = ''; 
$config['cookie_path']      = '/; SameSite=None';
$config['cookie_secure']    = TRUE;
$config['cookie_httponly']  = FALSE;
    Login or Signup to reply.
  3. 0

    There is an official issue on CI for this issue, check this :
    https://github.com/bcit-ci/CodeIgniter/issues/5791

    Note that this fix needs PHP 7.3

    Login or Signup to reply.
  4. 0

    Never modify the files in the SYSTEM directory, because you may have problems updating the codeigniter. It is better that, in APPLICATION/CORE, you create a file called MY_Security.php and extend the Security controller.

    Example:

    <?php defined('BASEPATH') OR exit('No direct script access allowed');

class MY_Security extends CI_Security {

    /**
     * CSRF Set Cookie with samesite
     *
     * @codeCoverageIgnore
     * @return  CI_Security
     */
    public function csrf_set_cookie()
    {
        $expire = time() + $this->_csrf_expire;
        $secure_cookie = (bool) config_item('cookie_secure');

        if ($secure_cookie && ! is_https())
        {
            return FALSE;
        }
        
        setcookie($this->_csrf_cookie_name,
                  $this->_csrf_hash,
                  ['samesite' => 'Strict',
                   'secure'   => true,
                   'expires'  => $expire,
                   'path'     => config_item('cookie_path'),
                   'domain'   => config_item('cookie_domain'),
                   'httponly' => config_item('cookie_httponly')]);
        
        log_message('info', 'CSRF cookie sent');

        return $this;
    }
}
    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search