Full SameSite cookie support

bryanjhv · Jul 2, 2020 · da8a3a7 · da8a3a7
1 parent f7ee3c2
commit da8a3a7
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/readme.md b/readme.md
@@ -42,7 +42,8 @@ $app->add(
 - `lifetime`: How much should the session last? Default `20 minutes`. Any
   argument that `strtotime` can parse is valid.
 - `path`, `domain`, `secure`, `httponly`, `samesite`: Options for the session
-  cookie. Please note that `samesite` is disabled by default.
+  cookie. Please note that `samesite` is `'Lax'` by default, set to `''` to
+  disable.
 - `name`: Name for the session cookie. Defaults to `slim_session` (instead of
   PHP's `PHPSESSID`).
 - **`autorefresh`**: `true` if you want session to be refresh when user activity

diff --git a/src/Slim/Middleware/Session.php b/src/Slim/Middleware/Session.php
@@ -43,7 +43,7 @@ public function __construct($settings = [])
             'domain' => '',
             'secure' => false,
             'httponly' => false,
-            'samesite' => '',
+            'samesite' => 'Lax',
             'name' => 'slim_session',
             'autorefresh' => false,
             'handler' => null,