Description
The 'secure' parameter of the Cookie constructor has a default value of true.
Since CookieLogin does not allow this value to be changed, always add the Secure attribute to prevent the cookie from being sent to the server when an HTTP request is made.
Please note that this issue does not occur on localhost.
Proposed solution:
final class CookieLogin
{
// ...
private bool $cookieSecure = true;
/**
* Returns a new instance with the specified auto-login cookie name.
*
* @param bool $secure Whether the client should send back the cookie only over HTTPS connection.
*/
public function withCookieSecure(bool $secure): self
{
$new = clone $this;
$new->cookieSecure = $secure;
return $new;
}
public function addCookie(
CookieLoginIdentityInterface $identity,
ResponseInterface $response,
DateInterval|null|false $duration = false,
): ResponseInterface
{
// ...
return (new Cookie(name: $this->cookieName, value: $cookieValue, expires: $expires))->withSecure($this->cookieSecure)->addToResponse($response);
}
public function expireCookie(ResponseInterface $response): ResponseInterface
{
return (new Cookie($this->cookieName))
->withSecure($this->cookieSecure)
->expire()
->addToResponse($response);
}
}Package version
2.3.2
PHP version
No response
Description
The 'secure' parameter of the Cookie constructor has a default value of true.
Since CookieLogin does not allow this value to be changed, always add the Secure attribute to prevent the cookie from being sent to the server when an HTTP request is made.
Please note that this issue does not occur on localhost.
Proposed solution:
Package version
2.3.2
PHP version
No response