removed samesite check using cookie (BC break)

Author: dg

src/Bridges/HttpDI/HttpExtension.php

@@ -53,7 +53,7 @@ public function getConfigSchema(): Nette\Schema\Schema
 			'cookiePath' => Expect::string()->dynamic(),
 			'cookieDomain' => Expect::string()->dynamic(),
 			'cookieSecure' => Expect::anyOf('auto', null, true, false)->firstIsDefault()->dynamic(), // Whether the cookie is available only through HTTPS
-			'disableNetteCookie' => Expect::bool(false), // disables cookie use by Nette
+			'disableNetteCookie' => Expect::bool(false)->deprecated(),
 		]);
 	}
 
@@ -150,13 +150,6 @@ private function sendHeaders(): void
 				$this->initialization->addBody('$response->setHeader(?, ?);', [$key, $value]);
 			}
 		}
-
-		if (!$config->disableNetteCookie) {
-			$this->initialization->addBody(
-				'Nette\Http\Helpers::initCookie($this->getService(?), $response);',
-				[$this->prefix('request')],
-			);
-		}
 	}
 
 

src/Http/Helpers.php

@@ -19,9 +19,6 @@ final class Helpers
 {
 	use Nette\StaticClass;
 
-	/** @internal */
-	public const StrictCookieName = '_nss';
-
 
 	/**
 	 * Formats a date and time in the HTTP date format (RFC 7231), e.g. 'Mon, 23 Jan 1978 10:00:00 GMT'.
@@ -107,16 +104,4 @@ public static function ipMatch(string $ip, string $mask): bool
 	{
 		return IPAddress::tryFrom($ip)?->isInRange($mask) ?? false;
 	}
-
-
-	/**
-	 * Sends the SameSite=Strict cookie used as a fallback for detecting same-site requests
-	 * in browsers that don't support the Sec-Fetch-Site header (Safari < 16.4).
-	 */
-	public static function initCookie(IRequest $request, IResponse $response): void
-	{
-		if ($request->getHeader('Sec-Fetch-Site') === null) {
-			$response->setCookie(self::StrictCookieName, '1', null, '/', sameSite: SameSite::Strict);
-		}
-	}
 }

src/Http/Request.php

@@ -8,7 +8,7 @@
 namespace Nette\Http;
 
 use Nette;
-use function array_change_key_case, array_filter, base64_decode, count, explode, func_num_args, in_array, is_array, preg_match, strcasecmp, strlen, strtr;
+use function array_change_key_case, base64_decode, count, explode, func_num_args, in_array, is_array, preg_match, strcasecmp, strlen, strtr;
 
 
 /**
@@ -242,7 +242,6 @@ public function isSameSite(): bool
 
 	/**
 	 * Checks whether the request matches the given Sec-Fetch-Site, Sec-Fetch-Dest and Sec-Fetch-User values.
-	 * Falls back to the SameSite=Strict cookie in browsers without Sec-Fetch (Safari < 16.4)
 	 * @param  FetchSite|list<FetchSite>  $site
 	 * @param  FetchDest|list<FetchDest>|null  $dest
 	 */
@@ -252,20 +251,12 @@ public function isFrom(
 		?bool $user = null,
 	): bool
 	{
-		$siteHeader = $this->headers['sec-fetch-site'] ?? null;
+		$actualSite = FetchSite::tryFrom($this->headers['sec-fetch-site'] ?? '');
 		$actualDest = FetchDest::tryFrom($this->headers['sec-fetch-dest'] ?? '');
 		$actualUser = ($this->headers['sec-fetch-user'] ?? null) === '?1';
 		$site = is_array($site) ? $site : [$site];
 		$dest = $dest === null || is_array($dest) ? $dest : [$dest];
 
-		if ($siteHeader === null) { // fallback for browsers without Sec-Fetch (Safari < 16.4)
-			return $dest === null
-				&& $user === null
-				&& isset($this->cookies[Helpers::StrictCookieName])
-				&& array_filter($site, fn(FetchSite $s) => $s !== FetchSite::CrossSite) !== [];
-		}
-
-		$actualSite = FetchSite::tryFrom($siteHeader);
 		return $actualSite !== null
 			&& in_array($actualSite, $site, strict: true)
 			&& ($dest === null || ($actualDest !== null && in_array($actualDest, $dest, strict: true)))

tests/Http.DI/HttpExtension.sameSiteProtection.disabled.phpt

@@ -80,46 +80,9 @@ test('unknown header value matches nothing', function () {
 });
 
 
-test('no header, no cookie returns false', function () {
+test('no Sec-Fetch-Site returns false', function () {
 	$request = new Http\Request(new Http\UrlScript);
 
 	Assert::false($request->isFrom(FetchSite::SameOrigin));
 	Assert::false($request->isFrom(FetchSite::CrossSite));
 });
-
-
-test('cookie fallback proves only "not cross-site"', function () {
-	$request = new Http\Request(new Http\UrlScript, cookies: [
-		Http\Helpers::StrictCookieName => '1',
-	]);
-
-	Assert::true($request->isFrom(FetchSite::SameOrigin));
-	Assert::true($request->isFrom(FetchSite::SameSite));
-	Assert::true($request->isFrom(FetchSite::None));
-	Assert::true($request->isFrom([FetchSite::SameOrigin, FetchSite::CrossSite]));
-	Assert::false($request->isFrom(FetchSite::CrossSite));
-});
-
-
-test('cookie fallback fails closed for dest & user', function () {
-	$request = new Http\Request(new Http\UrlScript, cookies: [
-		Http\Helpers::StrictCookieName => '1',
-	]);
-
-	// dest/user can't be proven by the cookie alone, so a stricter check must not pass
-	Assert::false($request->isFrom(FetchSite::SameOrigin, FetchDest::Document));
-	Assert::false($request->isFrom(FetchSite::SameOrigin, user: true));
-	Assert::false($request->isFrom(FetchSite::SameOrigin, user: false));
-});
-
-
-test('cookie fallback not used when Sec-Fetch-Site present', function () {
-	$request = new Http\Request(new Http\UrlScript, cookies: [
-		Http\Helpers::StrictCookieName => '1',
-	], headers: [
-		'Sec-Fetch-Site' => 'cross-site',
-	]);
-
-	Assert::false($request->isFrom(FetchSite::SameOrigin));
-	Assert::true($request->isFrom(FetchSite::CrossSite));
-});