From 80942fa2d7d9bf2776815fcb459fcab5bf129a2f Mon Sep 17 00:00:00 2001 From: Nathan van der Werf Date: Thu, 16 Aug 2018 19:44:18 +0200 Subject: [PATCH] Add Same-Site Cookie configuration option (#3688) Adds the session.same_site config key in the default session.php config file from Laravel. Credit to @nathan-van-der-werf & @Teranode --- config/session.php | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/config/session.php b/config/session.php index 3ee92a981..ef0589eec 100644 --- a/config/session.php +++ b/config/session.php @@ -150,4 +150,23 @@ return [ 'secure' => false, + /* + |-------------------------------------------------------------------------- + | Same-Site Cookies + |-------------------------------------------------------------------------- + | + | This option determines how your cookies behave when cross-site requests + | take place, and can be used to mitigate CSRF attacks. By default, we + | do not enable this as other CSRF protection services are in place. + | + | In the strict mode, the cookie is not sent with any cross-site usage + | even if the user follows a link to another website. Lax cookies are + | only sent with a top-level get request. + | + | Supported: "lax", "strict" + | + */ + + 'same_site' => null, + ];