CODEWITHSUNDEEP
codeignitercodeigniter-3
Panup Pong
Panup Pong

Reputation: 1891

Codeigniter 3 SameSite attribute for csrf protection

I have applications that make CORS calls to each other. Google in April 2020 will need SameSite cookies = none. https://www.chromestatus.com/feature/5633521622188032

Since chrome version 80+ all user that use chrome browser impact this csrf error. how to fix this problem on Codeigniter framework that using PHP 7.3

enter image description here

Upvotes: 4

Views: 17670

Answers (4)

Aythami
Aythami

Reputation: 51

Never modify the files in the SYSTEM directory, because you may have problems updating the codeigniter. It is better that, in APPLICATION/CORE, you create a file called MY_Security.php and extend the Security controller.

Example:

<?php defined('BASEPATH') OR exit('No direct script access allowed');

class MY_Security extends CI_Security {

    /**
     * CSRF Set Cookie with samesite
     *
     * @codeCoverageIgnore
     * @return  CI_Security
     */
    public function csrf_set_cookie()
    {
        $expire = time() + $this->_csrf_expire;
        $secure_cookie = (bool) config_item('cookie_secure');

        if ($secure_cookie && ! is_https())
        {
            return FALSE;
        }
        
        setcookie($this->_csrf_cookie_name,
                  $this->_csrf_hash,
                  ['samesite' => 'Strict',
                   'secure'   => true,
                   'expires'  => $expire,
                   'path'     => config_item('cookie_path'),
                   'domain'   => config_item('cookie_domain'),
                   'httponly' => config_item('cookie_httponly')]);
        
        log_message('info', 'CSRF cookie sent');

        return $this;
    }
}

Upvotes: 5

Mike
Mike

Reputation: 21

There is an official issue on CI for this issue, check this : https://github.com/bcit-ci/CodeIgniter/issues/5791

Note that this fix needs PHP 7.3

Upvotes: 2

Wilker Alves
Wilker Alves

Reputation: 101

I had this same problem but my PHP 7.2 and my CI 3.X. The problem was solved by making the following change to the applications / config / config.php file

$config['cookie_prefix']    = '';
$config['cookie_domain']    = ''; 
$config['cookie_path']      = '/; SameSite=None';
$config['cookie_secure']    = TRUE;
$config['cookie_httponly']  = FALSE;

Upvotes: 10

Panup Pong
Panup Pong

Reputation: 1891

Problem is solved

1.ADD this config at application/config/config.php for all cookie in framework

ini_set('session.cookie_samesite', 'None');
ini_set('session.cookie_secure', TRUE);

2.Edit this line at system/core/Security.php line ~273 replace from

setcookie(
                        $this->_csrf_cookie_name,
                        $this->_csrf_hash,
                        $expire,
                        config_item('cookie_path'),
                        config_item('cookie_domain'),
                        $secure_cookie,
                        config_item('cookie_httponly')
                );

to

setcookie($this->_csrf_cookie_name, $this->_csrf_hash, ['samesite' => 'None', 'secure' => true,'expires' => $expire, 'path' => config_item('cookie_path'), 'domain' => config_item('cookie_domain'), 'httponly' => config_item('cookie_httponly')]);

for csrf support SameSite attribute.

Upvotes: 2

Related Questions