Setting session.cookie_samesite=None in php ini does not set attribute of session samesite

To clarify, you're saying it works properly for you with php7.4 but not with php7.2? If that's true then there might be a patch to pull from upstream, although the bug you link isn't pointing to one, just a doc fix.

Also, what version of Ubuntu are you running? We only have php7.2 on bionic (18.04), would I guess correctly that's what you're on?

I believe this is the upstream change log entry that address the SameSite cookie issue I'm experiencing with the bionic php7.2 packaged.

https://www.php.net/ChangeLog-7.php#7.2.34

Added support for the SameSite cookie directive, including an alternative signature for setcookie(), setrawcookie() and session_set_cookie_params().

My fault for not including all information.

cat /etc/issue
Ubuntu 18.04.5 LTS \n \l

php7.2.24-0ubuntu0.18.04.7

Maybe this commit?

commit 2b58ab23c6ad3301b31a2015f5faa31801147dfd
Author: Pedro Magalhães <email address hidden>
Date: Thu Jul 19 02:40:39 2018 +0100

    Support for samesite cookies with array syntax

    Allows using an alternative array argument with
    support for the samesite option on the following
    functions:
    setcookie
    setrawcookie
    session_set_cookie_params

Adding the link

https://github.com/php/php-src/commit/2b58ab23c6ad3301b31a2015f5faa31801147dfd

Thanks for the pointers Bob, that patch does indeed look like a fix for this. I notice there was also a subsequent bugfix for https://bugs.php.net/patch-display.php?bug_id=77612.

I'm setting the bug to wishlist since the patch adds a new functionality for php7.2.

The stable release update (SRU) policy for Ubuntu permits regression fixes but typically does not allow new features unless there is a very compelling reason. So I'm unsure we'll be able to move forward with a fix for this in bionic, at least not through the SRU process.

If this php7.2 bug is not fixed the changes to cookies defaults in Chrome 80+ breaks many sites.

Like a webhook call back from PayPal (my problem) but any web site the requires SameSite=None will be broken.

Hi Bob, thanks for the quick reply with the note about the impact. That may impact the importance of the issue if we can understand it better.

If we will move forward with an SRU fix, we must be able to explain to the SRU review team precisely how users will be affected, and include a cohesive test case that can be run to verify the issue and its fix. Particularly so in this case since the patch is on the larger side, and as such has a higher regression risk (which means less likelihood of acceptance by the SRU team). So the more compelling the problem statement, and the more clear the test case, the better our chances.

Can you elaborate a further on what the breakages will look like?

Getting past a SRU review is a heavy lift without a guaranteed successful outcome/fix/patch.

I've convinced the powers that be to allow me to use a php7.4 PPA to fix the bug.

I'll state this again.

I'm surprised more people have not opened bugs or complained. As a php developer attempting to use PayPal Payflow Pro anyone with Chrome 80+ will not be able to use your web site with the bug in current release of php in bionic.

You can close this bug.

Thank you.

Bob, glad to hear that you found a workaround for yourself. But still for the overall user-base it would help a lot if we can make an SRU of it, but for that a good case is needed.
Even with you having found your own workaround it would be great if you could provide a detailed answer to the question of Bryce "Can you elaborate a further on what the breakages will look like?"