<p>It is actually possible but it's a little bit difficult for beginners. You'll need make use of <a href="https://www.yiiframework.com/doc/guide/2.0/en/concept-service-locator" rel="nofollow noreferrer">Service Locators</a> and overwrite <code>craft\web\Response</code> to change this method</p>

<pre class="lang-PHP prettyprint-override"><code>foreach ($this-&gt;getCookies() as $cookie) {
    $value = $cookie-&gt;value;
    if ($cookie-&gt;expire != 1 &amp;&amp; isset($validationKey)) {
        $value = Yii::$app-&gt;getSecurity()-&gt;hashData(serialize([$cookie-&gt;name, $value]), $validationKey);
    }
    setcookie($cookie-&gt;name, $value, $cookie-&gt;expire, $cookie-&gt;path, $cookie-&gt;domain, $cookie-&gt;secure, $cookie-&gt;httpOnly);
}
</code></pre>

<p><code>setcookie</code> is the key here, because if you use it like that, you can't really include the parameter, so you need call it accordingly with <a href="http://php.net/manual/en/function.setcookie.php" rel="nofollow noreferrer">options</a></p>

<pre class="lang-PHP prettyprint-override"><code>setcookie ( string $name [, string $value = "" [, array $options = [] ]] ) : bool
</code></pre>

<p>Each <code>yii\web\Cookie</code> only has the following Attributes</p>

<pre class="lang-PHP prettyprint-override"><code>public $name;
public $value = '';
public $domain = '';
public $expire = 0;
public $path = '/';
public $secure = false;
public $httpOnly = true;
</code></pre>

<p>Since there is no <code>sameSite</code> attribut you have to think about an intelligent way to set it. There is already a <a href="https://github.com/yiisoft/yii2/issues/14742" rel="nofollow noreferrer">feature request</a> for it. Maybe it's easier to ask about the current status.</p>

CC BY-SA 4.0
2019-03-12T17:46:28.150Z
Ah thanks. I'll probably monitor the feature request.
Andrea Hall
CC BY-SA 4.0
2019-03-11T19:30:38.810Z
2019-03-11T19:30:38.810Z
Robin Schambach
<p>I need to add the <code>SameSite</code> directive to my site's CSRF cookie, as explained in these <a href="https://infosec.mozilla.org/guidelines/web_security#directives-2" rel="nofollow noreferrer">mozilla security guidelines</a>. According to the <a href="https://craftcms.com/guides/enabling-csrf-protection" rel="nofollow noreferrer">Craft docs</a>, "Craft handles the cookie creation automatically." Is there a way I can configure the cookie? </p>

<csrf><cookies>
How to add CSRF cookie directive?
# How to add CSRF cookie directive?

(Asked by: username_0 on 2019-03-11)

I need to add the `SameSite` directive to my site's CSRF cookie, as explained in these [mozilla security guidelines](https://infosec.mozilla.org/guidelines/web_security#directives-2). According to the [Craft docs](https://craftcms.com/guides/enabling-csrf-protection), "Craft handles the cookie creation automatically." Is there a way I can configure the cookie?

**Tags:** csrf, cookies


---

## 1 answers

### Answer by username_1 on 2019-03-11. Score: 2

It is actually possible but it's a little bit difficult for beginners. You'll need make use of Service Locators and overwrite craft\web\Response to change this method
foreach ($this->getCookies() as $cookie) {
    $value = $cookie->value;
    if ($cookie->expire != 1 && isset($validationKey)) {
        $value = Yii::$app->getSecurity()->hashData(serialize([$cookie->name, $value]), $validationKey);
    }
    setcookie($cookie->name, $value, $cookie->expire, $cookie->path, $cookie->domain, $cookie->secure, $cookie->httpOnly);
}

setcookie is the key here, because if you use it like that, you can't really include the parameter, so you need call it accordingly with options
setcookie ( string $name [, string $value = "" [, array $options = [] ]] ) : bool

Each yii\web\Cookie only has the following Attributes
public $name;
public $value = '';
public $domain = '';
public $expire = 0;
public $path = '/';
public $secure = false;
public $httpOnly = true;

Since there is no sameSite attribut you have to think about an intelligent way to set it. There is already a feature request for it. Maybe it's easier to ask about the current status.

> **Comments:**
> **username_0**: Ah thanks. I'll probably monitor the feature request.  

---

