Answers.Body: <p>It is actually possible but it's a little bit difficult for beginners. You'll need make use of <a href="https://www.yiiframework.com/doc/guide/2.0/en/concept-service-locator" rel="nofollow noreferrer">Service Locators</a> and overwrite <code>craft\web\Response</code> to change this method</p>
  
  <pre class="lang-PHP prettyprint-override"><code>foreach ($this-&gt;getCookies() as $cookie) {
      $value = $cookie-&gt;value;
      if ($cookie-&gt;expire != 1 &amp;&amp; isset($validationKey)) {
          $value = Yii::$app-&gt;getSecurity()-&gt;hashData(serialize([$cookie-&gt;name, $value]), $validationKey);
      }
      setcookie($cookie-&gt;name, $value, $cookie-&gt;expire, $cookie-&gt;path, $cookie-&gt;domain, $cookie-&gt;secure, $cookie-&gt;httpOnly);
  }
  </code></pre>
  
  <p><code>setcookie</code> is the key here, because if you use it like that, you can't really include the parameter, so you need call it accordingly with <a href="http://php.net/manual/en/function.setcookie.php" rel="nofollow noreferrer">options</a></p>
  
  <pre class="lang-PHP prettyprint-override"><code>setcookie ( string $name [, string $value = "" [, array $options = [] ]] ) : bool
  </code></pre>
  
  <p>Each <code>yii\web\Cookie</code> only has the following Attributes</p>
  
  <pre class="lang-PHP prettyprint-override"><code>public $name;
  public $value = '';
  public $domain = '';
  public $expire = 0;
  public $path = '/';
  public $secure = false;
  public $httpOnly = true;
  </code></pre>
  
  <p>Since there is no <code>sameSite</code> attribut you have to think about an intelligent way to set it. There is already a <a href="https://github.com/yiisoft/yii2/issues/14742" rel="nofollow noreferrer">feature request</a> for it. Maybe it's easier to ask about the current status.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-03-12T17:46:28.150Z
Answers.Text: Ah thanks. I'll probably monitor the feature request.
Answers.UserDisplayName: Andrea Hall
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-03-11T19:30:38.810Z
Answers.LastActivityDate: 2019-03-11T19:30:38.810Z
Answers.UserDisplayName: Robin Schambach
Body: <p>I need to add the <code>SameSite</code> directive to my site's CSRF cookie, as explained in these <a href="https://infosec.mozilla.org/guidelines/web_security#directives-2" rel="nofollow noreferrer">mozilla security guidelines</a>. According to the <a href="https://craftcms.com/guides/enabling-csrf-protection" rel="nofollow noreferrer">Craft docs</a>, "Craft handles the cookie creation automatically." Is there a way I can configure the cookie? </p>
  
Tags: <csrf><cookies>
Title: How to add CSRF cookie directive?
ThreadText: # How to add CSRF cookie directive?
  
  (Asked by: username_0 on 2019-03-11)
  
  I need to add the `SameSite` directive to my site's CSRF cookie, as explained in these [mozilla security guidelines](https://infosec.mozilla.org/guidelines/web_security#directives-2). According to the [Craft docs](https://craftcms.com/guides/enabling-csrf-protection), "Craft handles the cookie creation automatically." Is there a way I can configure the cookie?
  
  **Tags:** csrf, cookies
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2019-03-11. Score: 2
  
  It is actually possible but it's a little bit difficult for beginners. You'll need make use of [Service Locators](https://www.yiiframework.com/doc/guide/2.0/en/concept-service-locator) and overwrite `craft\web\Response` to change this method
  
  ```PHP
  foreach ($this->getCookies() as $cookie) {
      $value = $cookie->value;
      if ($cookie->expire != 1 && isset($validationKey)) {
          $value = Yii::$app->getSecurity()->hashData(serialize([$cookie->name, $value]), $validationKey);
      }
      setcookie($cookie->name, $value, $cookie->expire, $cookie->path, $cookie->domain, $cookie->secure, $cookie->httpOnly);
  }
  
  ```
  
  `setcookie` is the key here, because if you use it like that, you can't really include the parameter, so you need call it accordingly with [options](http://php.net/manual/en/function.setcookie.php)
  
  ```PHP
  setcookie ( string $name [, string $value = "" [, array $options = [] ]] ) : bool
  
  ```
  
  Each `yii\web\Cookie` only has the following Attributes
  
  ```PHP
  public $name;
  public $value = '';
  public $domain = '';
  public $expire = 0;
  public $path = '/';
  public $secure = false;
  public $httpOnly = true;
  
  ```
  
  Since there is no `sameSite` attribut you have to think about an intelligent way to set it. There is already a [feature request](https://github.com/yiisoft/yii2/issues/14742) for it. Maybe it's easier to ask about the current status.
  
  > **Comments:**
  > **username_0**: Ah thanks. I'll probably monitor the feature request.  
  
  ---
  
  