Response: setCookie() forces Secure for SameSite=None

A cookie with SameSite=None is rejected by browsers unless it also carries the
Secure attribute (RFC 6265bis). setCookie() now enables Secure automatically in
that case, overriding both the $secure argument and the cookieSecure default.

Author: dg

src/Http/Response.php

@@ -257,15 +257,19 @@ public function setCookie(
 		}
 
 		$seconds = Helpers::expirationToSeconds($expire);
+		$sameSite ??= self::SameSiteLax;
+		$secure = $sameSite === self::SameSiteNone
+			? true // SameSite=None requires the Secure attribute, otherwise the browser rejects the cookie
+			: $secure ?? $this->cookieSecure;
 		// the value is raw-url-encoded the same way PHP reads it back from $_COOKIE;
 		// Max-Age takes precedence over expires (RFC 6265), expires is sent too for ancient clients
 		$cookie = $name . '=' . rawurlencode($value)
 			. ($seconds === null ? '' : '; expires=' . Helpers::formatDate(time() + $seconds) . '; Max-Age=' . max(0, $seconds))
 			. '; path=' . $path
 			. ($domain === '' ? '' : '; domain=' . $domain)
-			. (($secure ?? $this->cookieSecure) ? '; secure' : '')
+			. ($secure ? '; secure' : '')
 			. (($httpOnly ?? true) ? '; HttpOnly' : '')
-			. '; SameSite=' . ($sameSite ?? self::SameSiteLax);
+			. '; SameSite=' . $sameSite;
 		header('Set-Cookie: ' . $cookie, replace: false);
 		return $this;
 	}

tests/Http/Response.setCookie.phpt

@@ -135,6 +135,14 @@ Assert::exception(
 );
 
 
+// SameSite=None forces the Secure attribute (otherwise the browser rejects the cookie)
+$response = new Http\Response;
+$old = headers_list();
+$response->setCookie('test', 'value', null, sameSite: Http\IResponse::SameSiteNone);
+$headers = array_values(array_diff(headers_list(), $old, ['Set-Cookie:']));
+Assert::same(['Set-Cookie: test=value; path=/; secure; HttpOnly; SameSite=None'], $headers);
+
+
 // integer 0 is deprecated, but kept as a session cookie for BC
 $response = new Http\Response;
 $old = headers_list();