Repository: ampache/ampache (language: php)

Issue:
sidebar cookie SameSite value
Just noting this so I don't forget

```Cookie “sidebar_state” will be soon rejected because it has the “SameSite” attribute set to “None” or an invalid value, without the “secure” attribute. To know more about the “SameSite“ attribute, read https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite```


Discussion / hints:

Fix patch:
diff --git a/public/templates/header.inc.php b/public/templates/header.inc.php
index 719982b6bd..99f0beeb31 100644
--- a/public/templates/header.inc.php
+++ b/public/templates/header.inc.php
@@ -497,7 +497,7 @@ function libitem_action(item, action)
                     $('#sidebar').show(500);
                 });
 
-                Cookies.set('sidebar_state', newstate, { expires: 30, path: '/; samesite=strict'});
+                Cookies.set('sidebar_state', newstate, { expires: 30, path: '/', samesite: 'Strict'});
             });
             </script>
             <div id="rightbar" class="rightbar-fixed">
diff --git a/public/templates/show_html5_player.inc.php b/public/templates/show_html5_player.inc.php
index f45aa7fea1..0723b07aa6 100644
--- a/public/templates/show_html5_player.inc.php
+++ b/public/templates/show_html5_player.inc.php
@@ -258,7 +258,7 @@
     });
 
     $("#jquery_jplayer_1").bind($.jPlayer.event.volumechange, function(event) {
-        Cookies.set('jp_volume', event.jPlayer.options.volume, { expires: 7, path: '/; samesite=strict'});
+        Cookies.set('jp_volume', event.jPlayer.options.volume, { expires: 7, path: '/', samesite: 'Strict'});
     });
 
     $("#jquery_jplayer_1").bind($.jPlayer.event.resize, function (event) {
diff --git a/public/templates/show_html5_player_headers.inc.php b/public/templates/show_html5_player_headers.inc.php
index 4c03aa9795..15a9ab24b4 100644
--- a/public/templates/show_html5_player_headers.inc.php
+++ b/public/templates/show_html5_player_headers.inc.php
@@ -304,7 +304,7 @@ function ToggleReplayGain()
 
     if (replaygainNode != null) {
         replaygainEnabled = !replaygainEnabled;
-        document.cookie = 'replaygain=' + replaygainEnabled + ';samesite=lax';
+        Cookies.set('replaygain', replaygainEnabled, {path: '/', samesite: 'Strict'});
         ApplyReplayGain();
 
         if (replaygainEnabled) {
diff --git a/public/templates/sidebar.inc.php b/public/templates/sidebar.inc.php
index a010c4f97f..ec0b3e2c66 100644
--- a/public/templates/sidebar.inc.php
+++ b/public/templates/sidebar.inc.php
@@ -94,7 +94,7 @@
             if ($header.children(".header-img").hasClass("collapsed")) {
                 sbstate = "collapsed";
             }
-            Cookies.set('sb_' + $header.children(".header-img").attr('id'), sbstate, { expires: 30, path: '/; samesite=strict'});
+            Cookies.set('sb_' + $header.children(".header-img").attr('id'), sbstate, { expires: 30, path: '/', samesite: 'Strict'});
         });
 
     });
diff --git a/src/Module/Application/Logout/LogoutAction.php b/src/Module/Application/Logout/LogoutAction.php
index 35605e1a87..fafb2c2b0e 100644
--- a/src/Module/Application/Logout/LogoutAction.php
+++ b/src/Module/Application/Logout/LogoutAction.php
@@ -48,7 +48,7 @@ public function __construct(
     public function run(ServerRequestInterface $request, GuiGatekeeperInterface $gatekeeper): ?ResponseInterface
     {
         // To end a legitimate session, just call logout.
-        setcookie($this->configContainer->getSessionName() . '_remember', null, -1);
+        setcookie($this->configContainer->getSessionName() . '_remember', null, ['expires' => -1, 'samesite' => 'Strict']);
 
         $this->authenticationManager->logout('', false);
 
diff --git a/src/Module/System/InstallationHelper.php b/src/Module/System/InstallationHelper.php
index c7b2b81311..0dc2581a64 100644
--- a/src/Module/System/InstallationHelper.php
+++ b/src/Module/System/InstallationHelper.php
@@ -556,10 +556,16 @@ public function install_config_use_case($case)
                 $dbconfig['download']    = '0';
                 $dbconfig['allow_video'] = '0';
 
+                $cookie_options = [
+                    'expires' => time() + (30 * 24 * 60 * 60),
+                    'path' => '/',
+                    'samesite' => 'Strict'
+                ];
+
                 // Default local UI preferences to have a better 'minimalist first look'.
-                setcookie('sidebar_state', 'collapsed', time() + (30 * 24 * 60 * 60), '/');
-                setcookie('browse_album_grid_view', 'false', time() + (30 * 24 * 60 * 60), '/');
-                setcookie('browse_artist_grid_view', 'false', time() + (30 * 24 * 60 * 60), '/');
+                setcookie('sidebar_state', 'collapsed', $cookie_options);
+                setcookie('browse_album_grid_view', 'false', $cookie_options);
+                setcookie('browse_artist_grid_view', 'false', $cookie_options);
                 break;
             case 'community':
                 $trconfig['use_auth']                                = 'false';
diff --git a/src/Module/System/Session.php b/src/Module/System/Session.php
index 85fc4b7317..da4236fb86 100644
--- a/src/Module/System/Session.php
+++ b/src/Module/System/Session.php
@@ -178,15 +178,19 @@ public static function destroy($key)
 
         debug_event(self::class, 'Deleting Session with key:' . $key, 6);
 
-        $session_name  = AmpConfig::get('session_name');
-        $cookie_path   = AmpConfig::get('cookie_path');
-        $cookie_domain = '';
-        $cookie_secure = make_bool(AmpConfig::get('cookie_secure'));
+        $session_name   = AmpConfig::get('session_name');
+        $cookie_options = [
+            'expires' => -1,
+            'path' => AmpConfig::get('cookie_path'),
+            'domain' => AmpConfig::get('cookie_domain'),
+            'secure' => make_bool(AmpConfig::get('cookie_secure')),
+            'samesite' => 'Strict'
+        ];
 
         // Destroy our cookie!
-        setcookie($session_name, '', -1, $cookie_path, $cookie_domain, $cookie_secure);
-        setcookie($session_name . '_user', '', -1, $cookie_path, $cookie_domain, $cookie_secure);
-        setcookie($session_name . '_lang', '', -1, $cookie_path, $cookie_domain, $cookie_secure);
+        setcookie($session_name, '', $cookie_options);
+        setcookie($session_name . '_user', '', $cookie_options);
+        setcookie($session_name . '_lang', '', $cookie_options);
 
         return true;
     }
@@ -366,10 +370,17 @@ public static function check()
             return false;
         }
 
+        $cookie_options = [
+            'expires' => (int)AmpConfig::get('cookie_life'),
+            'path' => (string)AmpConfig::get('cookie_path'),
+            'domain' => (string)AmpConfig::get('cookie_domain'),
+            'secure' => make_bool(AmpConfig::get('cookie_secure')),
+            'samesite' => 'Strict'
+        ];
+
         // Set up the cookie params before we start the session.
         // This is vital
-        session_set_cookie_params((int)AmpConfig::get('cookie_life'), (string)AmpConfig::get('cookie_path'),
-            (string)AmpConfig::get('cookie_domain'), make_bool(AmpConfig::get('cookie_secure')));
+        session_set_cookie_params($cookie_options);
         session_write_close();
 
         // Set name
@@ -549,15 +560,18 @@ static function (): void {
     public static function create_cookie()
     {
         // Set up the cookie prefs before we throw down, this is very important
-        $cookie_life   = (int)AmpConfig::get('cookie_life');
-        $cookie_path   = (string)AmpConfig::get('cookie_path');
-        $cookie_domain = '';
-        $cookie_secure = make_bool(AmpConfig::get('cookie_secure'));
+        $cookie_options = [
+            'expires' => (int)AmpConfig::get('cookie_life'),
+            'path' => (string)AmpConfig::get('cookie_path'),
+            'domain' => (string)AmpConfig::get('cookie_domain'),
+            'secure' => make_bool(AmpConfig::get('cookie_secure')),
+            'samesite' => 'Strict'
+        ];
 
         if (isset($_SESSION)) {
-            setcookie(session_name(), session_id(), $cookie_life, $cookie_path, $cookie_domain, $cookie_secure);
+            setcookie(session_name(), session_id(), $cookie_options);
         } else {
-            session_set_cookie_params($cookie_life, $cookie_path, $cookie_domain, $cookie_secure);
+            session_set_cookie_params($cookie_options);
         }
         session_write_close();
         session_name(AmpConfig::get('session_name'));
@@ -578,15 +592,17 @@ public static function create_cookie()
      */
     public static function create_user_cookie($username)
     {
-        $cookie_life   = AmpConfig::get('cookie_life');
-        $session_name  = AmpConfig::get('session_name');
-        $cookie_path   = AmpConfig::get('cookie_path');
-        $cookie_domain = '';
-        $cookie_secure = make_bool(AmpConfig::get('cookie_secure'));
-
-        setcookie($session_name . '_user', $username, $cookie_life, $cookie_path, $cookie_domain, $cookie_secure);
-        setcookie($session_name . '_lang', AmpConfig::get('lang'), $cookie_life, $cookie_path, $cookie_domain,
-            $cookie_secure);
+        $session_name   = AmpConfig::get('session_name');
+        $cookie_options = [
+            'expires' => AmpConfig::get('cookie_life'),
+            'path' => AmpConfig::get('cookie_path'),
+            'domain' => AmpConfig::get('cookie_domain'),
+            'secure' => make_bool(AmpConfig::get('cookie_secure')),
+            'samesite' => 'Strict'
+        ];
+
+        setcookie($session_name . '_user', $username, $cookie_options);
+        setcookie($session_name . '_lang', AmpConfig::get('lang'), $cookie_options);
     }
 
     /**
@@ -597,11 +613,15 @@ public static function create_user_cookie($username)
      */
     public static function create_remember_cookie($username)
     {
-        $remember_length = AmpConfig::get('remember_length');
         $session_name    = AmpConfig::get('session_name');
-        $cookie_path     = AmpConfig::get('cookie_path');
-        $cookie_domain   = '';
-        $cookie_secure   = make_bool(AmpConfig::get('cookie_secure'));
+        $remember_length = time() + AmpConfig::get('remember_length');
+        $cookie_options  = [
+            'expires' => $remember_length,
+            'path' => AmpConfig::get('cookie_path'),
+            'domain' => AmpConfig::get('cookie_domain'),
+            'secure' => make_bool(AmpConfig::get('cookie_secure')),
+            'samesite' => 'Strict'
+        ];
 
         $token = self::generateRandomToken(); // generate a token, should be 128 - 256 bit
         self::storeTokenForUser($username, $token, $remember_length);
@@ -609,7 +629,7 @@ public static function create_remember_cookie($username)
         $mac    = hash_hmac('sha256', $cookie, AmpConfig::get('secret_key'));
         $cookie .= ':' . $mac;
 
-        setcookie($session_name . '_remember', $cookie, time() + $remember_length, $cookie_path, $cookie_domain, $cookie_secure);
+        setcookie($session_name . '_remember', $cookie, $cookie_options);
     }
 
     /**
diff --git a/src/Module/Util/Captcha/easy_captcha_persistent_grant.php b/src/Module/Util/Captcha/easy_captcha_persistent_grant.php
index 284c9e472f..f0032a4369 100644
--- a/src/Module/Util/Captcha/easy_captcha_persistent_grant.php
+++ b/src/Module/Util/Captcha/easy_captcha_persistent_grant.php
@@ -52,7 +52,7 @@ public function solved($input = 0)
     public function grant()
     {
         if (!headers_sent()) {
-            setcookie($this->cookie(), $this->validity_token(), time() + 175 * CAPTCHA_TIMEOUT);
+            setcookie($this->cookie(), $this->validity_token(), ['expires' => time() + 175 * CAPTCHA_TIMEOUT, 'samesite' => 'Strict']);
             //} else {
             //    // $this->log("::grant", "COOKIES", "too late for cookies");
         }
diff --git a/src/Repository/Model/Browse.php b/src/Repository/Model/Browse.php
index 1382f84aff..94af824322 100644
--- a/src/Repository/Model/Browse.php
+++ b/src/Repository/Model/Browse.php
@@ -445,7 +445,7 @@ public function set_type($type, $custom_base = '')
     public function save_cookie_params($option, $value)
     {
         if ($this->get_type()) {
-            setcookie('browse_' . $this->get_type() . '_' . $option, $value, time() + 31536000, "/");
+            setcookie('browse_' . $this->get_type() . '_' . $option, $value, ['expires' => time() + 31536000, 'path' => "/", 'samesite' => 'Strict']);
         }
     }
 


Test patch: