diff --git a/core/assets/scaffold/files/default.services.yml b/core/assets/scaffold/files/default.services.yml index 8a6cdf2f77fa62d35be0be175039c0ec10b08333..eb530088efafbdd97b26debce9cffbe11d6c1583 100644 --- a/core/assets/scaffold/files/default.services.yml +++ b/core/assets/scaffold/files/default.services.yml @@ -37,13 +37,6 @@ parameters: # @default none # cookie_domain: '.example.com' # - # Set the SameSite cookie attribute: 'None', 'Lax', or 'Strict'. If set, - # this value will override the server value. See - # https://www.php.net/manual/en/session.security.ini.php for more - # information. - # @default no value - cookie_samesite: Lax - # # Set the session ID string length. The length can be between 22 to 256. The # PHP recommended value is 48. See # https://www.php.net/manual/session.security.ini.php for more information. diff --git a/core/misc/cspell/dictionary.txt b/core/misc/cspell/dictionary.txt index 5c5fa462786b8570381e3f128ffeb5da41b90906..bb74373f9df91a55187192c62a6a17a35de0911b 100644 --- a/core/misc/cspell/dictionary.txt +++ b/core/misc/cspell/dictionary.txt @@ -1031,7 +1031,6 @@ safa sameline samename sameorigin -samesite sata savepoints sayre diff --git a/core/modules/system/system.install b/core/modules/system/system.install index b0659ff3dd80558a98d89125b1e326d636ec4baf..a896ba9897435a082dcab1fd3097ca1bff785939 100644 --- a/core/modules/system/system.install +++ b/core/modules/system/system.install @@ -1309,28 +1309,6 @@ function system_requirements($phase) { } } - // Check if the SameSite cookie attribute is set to a valid value. Since this - // involves checking whether we are using a secure connection this only makes - // sense inside an HTTP request, not on the command line. - if ($phase === 'runtime' && PHP_SAPI !== 'cli') { - $samesite = ini_get('session.cookie_samesite') ?: t('Not set'); - // Check if the SameSite attribute is set to a valid value. If it is set to - // 'None' the request needs to be done over HTTPS. - $valid = match ($samesite) { - 'Lax', 'Strict' => TRUE, - 'None' => $request_object->isSecure(), - default => FALSE, - }; - $requirements['php_session_samesite'] = [ - 'title' => t('SameSite cookie attribute'), - 'value' => $samesite, - 'severity' => $valid ? REQUIREMENT_OK : REQUIREMENT_WARNING, - 'description' => t('This attribute should be explicitly set to Lax, Strict or None. If set to None then the request must be made via HTTPS. See <a href=":url" target="_blank">PHP documentation</a>', [ - ':url' => 'https://www.php.net/manual/en/session.configuration.php#ini.session.cookie-samesite', - ]), - ]; - } - // See if trusted hostnames have been configured, and warn the user if they // are not set. if ($phase == 'runtime') { diff --git a/core/tests/Drupal/Tests/Core/Session/SessionConfigurationTest.php b/core/tests/Drupal/Tests/Core/Session/SessionConfigurationTest.php index 55282c05483c3e945a50b4e84c8ce4ee28ecacec..ac6b0a769748b3aa7f60b891a62c9a1c2edaf106 100644 --- a/core/tests/Drupal/Tests/Core/Session/SessionConfigurationTest.php +++ b/core/tests/Drupal/Tests/Core/Session/SessionConfigurationTest.php @@ -116,17 +116,6 @@ public function testCookieSecure($uri, $expected_secure) { $this->assertEquals($expected_secure, $options['cookie_secure']); } - /** - * Test that session.cookie_samesite is configured correctly. - */ - public function testSameSiteCookie() { - $request = Request::create('https://example.com'); - - $config = $this->createSessionConfiguration(['cookie_samesite' => 'Strict']); - $options = $config->getOptions($request); - $this->assertEquals('Strict', $options['cookie_samesite']); - } - /** * Tests that session.cookie_secure ini settings cannot be overridden. * diff --git a/sites/default/default.services.yml b/sites/default/default.services.yml index 8a6cdf2f77fa62d35be0be175039c0ec10b08333..eb530088efafbdd97b26debce9cffbe11d6c1583 100644 --- a/sites/default/default.services.yml +++ b/sites/default/default.services.yml @@ -37,13 +37,6 @@ parameters: # @default none # cookie_domain: '.example.com' # - # Set the SameSite cookie attribute: 'None', 'Lax', or 'Strict'. If set, - # this value will override the server value. See - # https://www.php.net/manual/en/session.security.ini.php for more - # information. - # @default no value - cookie_samesite: Lax - # # Set the session ID string length. The length can be between 22 to 256. The # PHP recommended value is 48. See # https://www.php.net/manual/session.security.ini.php for more information.