session.cookie_samesite

INI • INI default value changed in 8.6

Session: session.cookie_samesite — Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF) Current valid values are "Strict", "Lax" or "None". When using "None", make sure to include the quotes, as none is interpreted like false in ini files. https://tools.ietf.org/html/draft-west-first-party-cookies-07


Default value	`"Lax"`
Development value	`"Lax"`
Production value	`"Lax"`

Modifiability: INI_ALL - The session.cookie_samesite INI directive can be configured anywhere, including php.ini files, ini_set calls, Apache .htaccess files, per-directory .ini files, etc.

PHP 5

PHP 7.0-7.2

PHP 7.3

Added

PHP 7.4

PHP 8.0-8.1

PHP 8.2-8.3

PHP 8.4

PHP 8.5

PHP 8.6

Changed

[Session]
session.cookie_samesite = "Lax"

Changes to the `session.cookie_samesite` INI

PHP 8.6

INI directive default value set to Lax

PHP 7.3

INI directive added