开发者 | ayeshrajans |
---|---|
更新时间 | 2023年7月23日 20:18 |
PHP版本: | 7.0 及以上 |
WordPress版本: | 6.3 |
版权: | GPLv2 or later |
Lax
(default), Strict
, or None
. You can read about SameSite cookies here.
To configure the SameSite
flag value, edit your WordPress configuration file (wp-config.php
), and add the following lines right above /** Sets up WordPress vars and included files. */
.
define( 'WP_SAMESITE_COOKIE', 'Lax' ); // Pick from 'Lax', 'Strict', or 'None'.
Note that only the authentication cookies are affected. Regular cookies that your installed plugins set will not be affected, nor provide any meaningful value with SameSite
flags.
Yeah, probably. This plugin uses what's called "pluggable functions" supported in WordPress to replace wp_set_auth_cookie
function.
This means that any other plugin that tampers with the login cookie parameters will override this plugin, and this plugin may not even get a chance to do what it does.
Go to the Login page of your WordPress site, and open your browser's development tools. Inspect the HTTP POST request made by the browser when you submit the login form. The response headers for Setcookie
response headers must contain Samesite=Lax
(or the configured value) if the plugin is working.
Note that cookies apart from the authentication cookies are not handled by this plugin, nor it makes sense to add SameSite attribute to them.
See the screenshot as well.
No. PHP 7.3 officially added SameSite cookie support, but this plugin comes with a polyfill to extend support to all previous PHP versions.
Without SameSite cookie, WordPress core and third party plugins must implement their own CSRF checks, which can be overlooked, intentionally ignored, or sometimes not even have thought about, which can be the case for contributed plugin. This plugin attempts to solve this with different take and complement existing solutions.