We need the "Partitioned" parameter to be added to setcookie() options.

[Fell-x27]

Description

As stated here (link), soon our cookies with SameSite=None; Secured, without the Partitioned parameter, will stop working.

Currently, there is no capability to add this parameter through setcookie(). A temporary solution could be to use header() to form the header, but it would be better to avoid this.

Google Chrome marks these cookies as deprecated already:

[damianwadley]

Precedent: SameSite was implemented in PHP while the standard was still in draft status, with the rationale being that other libraries had already implemented it. Symfony has added support for Partitioned.

This may require an RFC, if just to decide once and for all whether or not to:
(a) Continue supporting the many-parameter syntax for setcookie(), which is becoming more and more unwieldy as more cookie options are invented, though named parameters does alleviate some of that complexity,
(b) Double-down on the options array, and at the same time I'd question whether the array needs to be locked-down as it is or whether it could be opened up to free-form options (🦶🔫),
(c) Switch to a whole new API entirely, such as an OOP builder.

There is a similar RFC for SameSite that's gone stale.

[nielsdos]

Certainly not hard to implement at our side. Here's a proof-of-concept that adds the option to the setcookie() $options argument: #12652

I'm not sure whether adding the option to the $options array requires an RFC, but probably changing the signature does indeed. I agree with Damian that should be resolved together with "what to do with SameSite argument?" and we should indeed answer the a, b, c questions too.

[Fell-x27]

Certainly not hard to implement at our side. Here's a proof-of-concept that adds the option to the setcookie() $options argument: #12652

I'm not sure whether adding the option to the $options array requires an RFC, but probably changing the signature does indeed. I agree with Damian that should be resolved together with "what to do with SameSite argument?" and we should indeed answer the a, b, c questions too.

Well, the array already allows more than args, so it wasn't a problem before as I see it :)

[DustinAPI]

Google has sent out the notification that 1% of all chrome browsers will be using this on Jan 4, 2024!

https://blog.google/products/chrome/privacy-sandbox-tracking-protection/?utm_campaign=FY24Q2_GL_PRA_CUST_Google-LTI1.3_EN_FOL_CB-60516&utm_medium=email&utm_source=FY24Q2_GL_PRA_CUST_Google-LTI1.3_EN_FOL_CB-60516&utm_content=Product%2FBrand%20Announcement&utm_term=Upcoming%20Google%20Chrome%20changes%20that%20may%20impact%20LTI%20integrations

If this has not been handled elsewhere I think it needs to be put on high priority. Especially the $options version of setcookie as it already added samesite.

[nielsdos]

As requested by Ilija I sent an email to the mailing list to be able to move forward with the PR.

[Fell-x27]

It might also be necessary to include this option in the list of arguments for the session_set_cookie_params function.

[dxh9845]

To be clear, is there an alternative option for setting cookies if the partitioned parameter isn't allowed? I'm looking to support this for a PHP webapp at work that requires cross-site cookies for session management - specifically session_set_cookie_params. Without the Partitioned attribute, Chrome will drop this cookie from being set.

[DustinAPI]

@dxh9845 there are a couple of other alternatives to partitioned cookies suggested by chrome.

https://developers.google.com/privacy-sandbox/3pcd

[snake]

@dxh9845 it's possible, using header() directly (as suggested on the setcookie docs page) . It's not a particularly elegant solution by any measure, but it works just fine for Chrome partitioning support.

[wbdoll]

@dxh9845 I just tried the following and it seems to work. Maybe someone can let us know if this is not a reliable solution.
<?php
session_start();
$id = session_id();
header("Set-Cookie: PHPSESSID=$id; Secure; Path=/; SameSite=None; Partitioned;");
?>

[rbalik]

Hi, glad to see you all are working on this. The warnings in Chrome are getting scarier :)
Was wondering how this would work with session cookies. Would this just be an option passed to session_start?

[jsnajdr]

It would be nice if the native setcookie function started supporting the Partitioned attribute. Firefox and Chrome already implement it and ship it in production. 3rd party cookies blocking is enabled by default for many users. Both browsers will reject your cookies in certain scenarios if they don't have the Partitioned attribute. Production sites need to be updated if they want to continue working as 3rd party embeds. There is a patch in #12652 ready to be reviewed and merged.

[nielsdos]

I'm going to work on an RFC, that includes the session and setcookie stuff, sometime in the near future such that 8.4 will support this.

[running-grass]

ini_set('session.cookie_path', '/; Partitioned');

It tried it, it looks good.

[scollovati]

Setting the cookie via the HTTP Header (which is the way implemented by Symfony https://symfony.com/blog/new-in-symfony-6-4-chips-cookies) is not feasible with session cookies. The option for partitioned ones needs to be set also there: https://www.php.net/manual/en/session.configuration.php

[Fell-x27]

Setting the cookie via the HTTP Header (which is the way implemented by Symfony https://symfony.com/blog/new-in-symfony-6-4-chips-cookies) is not feasible with session cookies. The option for partitioned ones needs to be set also there: https://www.php.net/manual/en/session.configuration.php

But you can still write your own session cookie handler/manager... Not the best solution, but still better than nothing.

[renandecarlo]

This worked for me:

setcookie('cookie', $cipherData, [
	'expires' => strtotime('+ 3 hours'), 
	'path' => '/',
	'httponly' => true,
	'secure' => true,
	'samesite' => 'None; Partitioned' /* Hack to make CHIPS: https://github.com/php/php-src/issues/12646 */ 
]);

[lianee]

This worked for me:

If you want that all cookies use this (even the PHPSESSID), you can do something like this this before session_start:

session_set_cookie_params(['path' => '/', 'samesite' => 'None; Partitioned', 'secure' => true]);

[AlainArachnid]

I use the following, for apache2/PHP, that works with firefox 132.0 and chrome 130.0.6723.92.
Before each session_start()

ini_set('session.cookie_path', '/; Partitioned; Secure; SameSite=None');
session_name('APPNAMESESS');
session_start();

session_name is here to be able to track things in a cross-domain case, both on PHP