SameSiteNoneWithoutSecure

warning native on by default PHP ≥ 7.3

Group: Probable bugs

Detect setcookie with literal options selecting SameSite None and secure absent or false.

Example

<?php
setcookie('sid', 'abc', ['samesite' => 'None', 'secure' => false]);

Reported:

• line 2: Use a Secure cookie with SameSite None.

Detection

• Report setcookie with literal options selecting SameSite None and secure absent or false.
• Option names are compared without regard to letter case, as PHP does: SameSite, SAMESITE, Secure and SECURE name the same options as their lower-case spellings.
• Resolve builtin calls and named arguments before checking the contract. Project-local callees are considered only when their bodies or immutable summaries establish the required facts. The default is enabled, with positive proof required.
• For flow-dependent conditions, require a reachable source-to-use path with no intervening invalidation. Unknown calls, ambiguous aliases, recursion or analysis-budget exhaustion cannot establish definite facts.

Exceptions (no report)

• Secure true, other SameSite policies, unknown options and unrelated user functions are excluded.
• An options array that spells one option name twice with different letter case is not reported: the effective value depends on entry order.
• Unresolved targets, incomplete required facts, suppressed findings and PHP versions lacking the referenced API or language feature produce no report. User declarations shadowing builtin names are not builtin contracts.

Fix

No automatic fix: enabling Secure can make a cookie unusable on non-HTTPS deployments; document the HTTPS prerequisite.

PHP versions

Available from PHP 7.3. Builtin behavior and argument contracts follow the configured PHP version. Extension-specific calls require resolved extension API symbols; do not treat same-named application functions as extension calls.

Options

None. Enable or disable this rule through normal rule configuration.

Configure

In custos.json:

{
  "rules": {
    "SameSiteNoneWithoutSecure": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore SameSiteNoneWithoutSecure